CVE-2017-16777: hashicorp vagrant Uncontrolled Search Path Element
Vulnerability summary
CVE-2017-16777 is a high (CVSS 7.8) Uncontrolled Search Path Element vulnerability in hashicorp vagrant. EPSS estimates a 0.98% chance of exploitation in the next 30 days, higher than 61.7% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 16-11-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a local attacker can create a fake application directory and exploit the suid sudo helper in order to escalate to root.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.98%
Chance of exploitation in the next 30 days
Percentile
62%
Versus all other CVEs
30-day change
0.00 pp
From 0.98% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (m4.rkw.io)
Maturity: unknown
Hashicorp vagrant-vmware-fusion 5.0.3 - Local Privilege Escalation
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Hashicorp1 product
- vagrant5.0.3
1 vendor · 1 product
References
2 links- m4.rkw.io/blog/cve201716777-local-root-privesc-in-hashicorp-vagrantvmwarefusion-503.htmlX Refsource MISCExploitIssue TrackingThird Party Advisory