Hashicorp Vagrant vulnerabilities

4 CVEs affecting Hashicorp Vagrant, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-5834, published 2023-10-27.

More from Hashicorp.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-16777, published 2017-11-16. High severity, CVSS 7.8. EPSS: 1% chance of exploitation in the next 30 days. If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a local attacker can create a fake application directory and exploit the suid sudo…
• CVE-2017-16001, published 2017-11-06. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently subvert the plugin update process in order to escalate to root privileges.
• CVE-2022-42717, published 2022-10-11. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation,…
• CVE-2023-5834, published 2023-10-27. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0.