CVE-2020-15511

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

HashiCorp Terraform Enterprise up to v202006-1 contained a default signup page that allowed user registration even when disabled, bypassing SAML enforcement. Fixed in v202007-1.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/hashicorp/terraform-enterprise-release-notes/blob/master/v202007-1.mdRelease Notes, Third Party Advisory
https://www.hashicorp.com/blog/category/terraform/Vendor Advisory
https://github.com/hashicorp/terraform-enterprise-release-notes/blob/master/v202007-1.mdRelease Notes, Third Party Advisory
https://www.hashicorp.com/blog/category/terraform/Vendor Advisory

Timeline

Published: Jul 30, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-155135.3The typo3_forum extension before 1.2.1 for TYPO3 has Incorrect Access Control.CVE-2020-155145.4The jh_captcha extension through 2.1.3, and 3.x through 3.0.2, for TYPO3 allows XSS.CVE-2020-155158.8The turn extension through 0.3.2 for TYPO3 allows Remote Code Execution.CVE-2020-155165.4The mm_forum extension through 1.9.5 for TYPO3 allows XSS that can be exploited via CSRF.CVE-2020-155175.4The ke_search (aka Faceted Search) extension through 2.8.2, and 3.x through 3.1.3, for TYPO3 allows XSS.CVE-2020-155188.8VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, which allows unprivil CVE-2020-15528.0An elevation of privilege vulnerability exists when the Windows Work Folder Service improperly handles file operations. An attacker who succ CVE-2020-155216.1Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting (XSS) .CVE-2020-155225.9Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue wi CVE-2020-155237.8In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might CVE-2020-155255.3GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint.CVE-2020-155265.9In Redgate SQL Monitor 7.1.4 through 10.1.6 (inclusive), the scope for disabling some TLS security certificate checks can extend beyond that