CVE-2021-40862

Name of the Vulnerable Software and Affected Versions HashiCorp Terraform Enterprise versions up to v202108-1

Description The issue concerns an API endpoint that incorrectly disclosed a sensitive URL to authenticated users. This could potentially be exploited for privilege escalation or to make unauthorized changes to a Terraform configuration.

Recommendations For HashiCorp Terraform Enterprise versions up to v202108-1, update to version v202109-1 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected API endpoint to minimize the risk of exploitation.