Auth bypass in Pacovk Tapir
CVE-2024-56802
Tapir is a private Terraform registry. Tapir versions 0.9.0 and 0.9.1 are facing a critical issue with scope-able Deploykeys where attackers can guess the key to get write access to the registry. User must upgrade to 0.9.2.
EPSS: 0.004 (29.5th percentile) — read the EPSS interpretation.
Affected products
- Pacovk Tapir — versions >= 0.9.0, < 0.9.2
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)