Description
HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HashiCorp | Vagrant | < 2.4.0 | 2.4.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/hashicorp/vagrant | < 2.4.0 | 2.4.0 | GHSA-47xw-vw6m-w9fq |
Advisories 1
- WID-SEC-2023-2772 Hashicorp Vagrant: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Oct 29, 2023