{"cve":"CVE-2023-30618","nvd":{"published":"2023-04-21T20:15:07.767","modified":"2026-06-17T05:55:09.647","status":"Modified","description":"Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and verify the resulting infrastructure systems with InSpec controls. Kitchen-Terraform v7.0.0 introduced a regression which caused all Terraform output values, including sensitive values, to be printed at the `info` logging level during the `kitchen converge` action. Prior to v7.0.0, the output values were printed at the `debug` level to avoid writing sensitive values to the terminal by default. An attacker would need access to the local machine in order to gain access to these logs during an operation. Users are advised to upgrade. There are no known workarounds for this vulnerability.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":3.3},"cwes":["CWE-532"],"references":["https://github.com/newcontext-oss/kitchen-terraform/commit/3d20d60e7a891e2dd747df995a31226fa0b4ac48","https://github.com/newcontext-oss/kitchen-terraform/security/advisories/GHSA-65g2-x53q-cmf6","https://github.com/newcontext-oss/kitchen-terraform/commit/3d20d60e7a891e2dd747df995a31226fa0b4ac48","https://github.com/newcontext-oss/kitchen-terraform/security/advisories/GHSA-65g2-x53q-cmf6"],"products":["kitchen-terraform_project:kitchen-terraform"],"source":"nvd","synced_at":"2026-10-19T21:38:05.473481323+00:00"},"epss":{"cve":"CVE-2023-30618","score":0.00212,"percentile":0.1156,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-65g2-x53q-cmf6","url":"https://osv.dev/vulnerability/GHSA-65g2-x53q-cmf6","summary":"Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform","modified":"2026-09-10T03:49:53.498091624Z","packages":[{"ecosystem":"RubyGems","name":"kitchen-terraform","purl":"pkg:gem/kitchen-terraform","ranges":[">=7.0.0 <7.0.1"],"fixed":["7.0.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}