GHSA-47xw-vw6m-w9fq

ghsaUSosv

HashiCorp Vagrant Insecure Operation on Windows Junction / Mount Point vulnerability

view advisory published 2023-10-28Licence: CC-BY-4.0

HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-5834US	high7.8	0.24% (15th)	—	2023-10-27
HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixe…

references

External citations — patches, advisories, analysis.

https://discuss.hashicorp.com/t/hcsec-2023-31-vagrant-s-windows-installer-allowed-directory-junction-write/59568WEB
https://github.com/hashicorp/vagrantPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2023-5834ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan