Hashicorp Vagrant vulnerabilities
5 vulnerabilities
Known vulnerabilities in Hashicorp Vagrant, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2022-42717ubuntuvagrant+1
EPSS score0.25%
An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.CVE-2017-16001hashicorpvagrantEPSS score0.93%
In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently subvert the plugin update process in order to escalate to root privileges.CVE-2017-16777hashicorpvagrantEPSS score0.98%
If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a local attacker can create a fake application directory and exploit the suid sudo helper in order to escalate to root.CVE-2024-10228hashicorpvagrant+1EPSS score0.14%
The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMWare Utility 1.0.23CVE-2023-5834github.com/hashicorpvagrant+1EPSS score0.22%
HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0.