CVE-2023-30618

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and verify the resulting infrastructure systems with InSpec controls. Kitchen-Terraform v7.0.0 introduced a regression which caused all Terraform output values, including sensitive values, to be printed at the `info` logging level during the `kitchen converge` action. Prior to v7.0.0, the output values were printed at the `debug` level to avoid writing sensitive values to the terminal by default. An attacker would need access to the local machine in order to gain access to these logs during an operation. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Apr 21, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-306195.4Tuleap Open ALM is a Libre and Open Source tool for end to end traceability of application and system developments. The title of an artifactCVE-2023-30629.8A vulnerability was found in code-projects Agro-School Management System 1.0. It has been classified as critical. Affected is an unknown funCVE-2023-306207.5mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed uCVE-2023-306219.8Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run commanCVE-2023-306228.8Clusternet is a general-purpose system for controlling Kubernetes clusters across different environments. An issue in clusternet prior to veCVE-2023-306238.8`embano1/wip` is a GitHub Action written in Bash. Prior to version 2, the `embano1/wip` action uses the `github.event.pull_request.title` pCVE-2023-306248.8Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instaCVE-2023-306258.8rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulneraCVE-2023-306268.1Jellyfin is a free-software media system. Versions starting with 10.8.0 and prior to 10.8.10 and prior have a directory traversal vulnerabilCVE-2023-306275.4jellyfin-web is the web client for Jellyfin, a free-software media system. Starting in version 10.1.0 and prior to version 10.8.10, a storedCVE-2023-306288.8Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior, the `changelogCVE-2023-306297.5Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates
CVE-2023-30618: Low severity, CVSS 3.3 | Vulnix