CVE-2023-5834 Vagrant’s Windows Installer Allowed Directory Junction Write

2023-10-2721:06:38

CWE-1386

HashiCorp

www.cve.org

cve-2023-5834

vagrant

windows

installer

directory junction

write

hashicorp

CVSS3

3.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

EPSS

Percentile

9.0%

JSON

HashiCorp Vagrant’s Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0.

CNA Affected

[
  {
    "vendor": "HashiCorp",
    "product": "Vagrant",
    "platforms": [
      "Windows",
      "64 bit",
      "32 bit"
    ],
    "versions": [
      {
        "lessThan": "2.4.0",
        "status": "affected",
        "version": "*",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]