CVE-2025-13432

{"id": "CVE-2025-13432", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@hashicorp.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2025-11-21T15:15:51.660", "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2025-34-terraform-enterprise-state-versions-can-be-created-by-users-without-sufficient-write-access/76821", "tags": ["Vendor Advisory"], "source": "security@hashicorp.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@hashicorp.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied. This vulnerability, CVE-2025-13432, is fixed in Terraform Enterprise version 1.1.1 and 1.0.3."}], "lastModified": "2025-12-10T21:02:36.733", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hashicorp:terraform:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "6A2FB703-8C61-40EF-BA89-DBB5CE5BBCB4", "versionEndExcluding": "1.0.3", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:hashicorp:terraform:1.1.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "DC8C7167-D556-4C85-AE6F-9B78C5004DC6"}], "operator": "OR"}]}], "sourceIdentifier": "security@hashicorp.com"}