CVE-2024-47083— Microsoft Power Platform Terraform Provider 安全漏洞
一分钟漏洞结论
影响对象
microsoft terraform-provider-power-platform
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Microsoft Power Platform Terraform Provider是美国微软（Microsoft）公司的一个电力平台提供商。 Microsoft Power Platform Terraform Provider 3.0.0之前版本存在安全漏洞，该漏洞源于日志记录代码中的错误，导致在保留或查看日志时无法正确屏蔽敏感记录。
可能的 ATT&CK 技术 1 AI
T1005 · Data from Local System
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2024-47083 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Power Platform Terraform Provider has Improper Masking of Secrets in Logs
来源: CVE Program / CVE List V5
Vulnerability Description
Power Platform Terraform Provider allows managing environments and other resources within Power Platform. Versions prior to 3.0.0 have an issue in the Power Platform Terraform Provider where sensitive information, specifically the `client_secret` used in the service principal authentication, may be exposed in logs. This exposure occurs due to an error in the logging code that causes the `client_secret` to not be properly masked when logs are persisted or viewed. Users should upgrade to version 3.0.0 to receive a patched version of the provider that removes all logging of sensitive content. Users who have used this provider with the affected versions should take the following additional steps to mitigate the risk: Immediately rotate the `client_secret` for any service principal that has been configured using this Terraform provider. This will invalidate any potentially exposed secrets. Those who have set the `TF_LOG_PATH` environment variable or configured Terraform to persist logs to a file or an external system, consider disabling this until they have updated to a fixed version of the provider. Those who have existing logs that may contain the `client_secret` should remove or sanitize these logs to prevent unauthorized access. This includes logs on disk, in monitoring systems, or in logging services.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
来源: CVE Program / CVE List V5
Vulnerability Type
日志输出的转义处理不恰当
来源: CVE Program / CVE List V5
Vulnerability Title
Microsoft Power Platform Terraform Provider 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Microsoft Power Platform Terraform Provider是美国微软（Microsoft）公司的一个电力平台提供商。 Microsoft Power Platform Terraform Provider 3.0.0之前版本存在安全漏洞，该漏洞源于日志记录代码中的错误，导致在保留或查看日志时无法正确屏蔽敏感记录。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| microsoft | terraform-provider-power-platform | < 3.0.0 | - |
|
二、漏洞 CVE-2024-47083 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2024-47083 的情报信息
请登录查看更多情报信息。
CVE-2024-47083 厂商安全公告 (1)
CVE-2024-47083 其他参考 (2)
IV. Related Vulnerabilities
V. Comments for CVE-2024-47083
暂无评论