CVE-2023-5834CWE-1386

Vagrant’s Windows Installer Allowed Directory Junction Write

Low · published October 27, 2023

CVSS v3.1
3.8
EPSS
0%
Percentile
12.2
In the wild
Unconfirmed
What it is

HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0.

The record
Technical detail
CVSS v3.1
3.8 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00223 · 12.2th percentile
Weakness
CWE-1386 · Insecure Operation on Windows Junction / Mount Point
Published
2023-10-27T21:06Z
EPSS history
Timeline
  • 27 OCT 21:06Z
    Vagrant’s Windows Installer Allowed Directory Junction Write
    cvelistv5