hashicorp/vagrant · Security
HashiCorp Vagrant Insecure Operation on Windows Junction / Mount Point vulnerability
- GHSA ID
- GHSA-47xw-vw6m-w9fq
- CVE ID
- CVE-2023-5834
- Severity
- low
- Published
- Updated
- CVSS
- 3.8 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
- CVSS v3
- 3.8 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Description
HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0.
CWEs
- CWE-59 · Improper Link Resolution Before File Access ('Link Following')
- CWE-1386 · Insecure Operation on Windows Junction / Mount Point