GitHub Advisoryadvisory · Go

GHSA-47xw-vw6m-w9fq HashiCorp Vagrant Insecure Operation on Windows Junction / Mount Point vulnerability

LOW Published 2023-10-28 Modified 2023-10-31 Official page ↗
Aliases
CVE-2023-5834
Ecosystem
Go
Packages
github.com/hashicorp/vagrant
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Weaknesses
CWE-1386, CWE-59
Reviewed
2023-10-31

Affected packages

• Go github.com/hashicorp/vagrant: < 2.4.0 → fixed in 2.4.0

Description

HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0.

Related

Alias · CVE (1)

  • CVE-2023-5834 HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential… vulnerability

Weakness · CWE (2)

  • CWE-1386 Insecure Operation on Windows Junction / Mount Point weakness
  • CWE-59 Improper Link Resolution Before File Access weakness

References