CVE-2023-5834
Improper Link Resolution Before File Access ('Link Following') (CWE-59)
Published: Oct 27, 2023 / Updated: 12mo ago
010
CVSS 7.8EPSS 0.04%High
CVE info copied to clipboard
HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Timeline
First Article
Feedly found the first article mentioning CVE-2023-5834. See article
Oct 27, 2023 at 9:05 PM / discuss.hashicorp.com
CVE Assignment
NVD published the first details for CVE-2023-5834
Oct 27, 2023 at 10:15 PM
EPSS
EPSS Score was set to: 0.04% (Percentile: 7.2%)
Oct 28, 2023 at 3:39 PM
Affected Systems
Hashicorp/vagrant
+null more
Patches
Github Advisory
+null more
Links to Mitre Att&cks
T1547.009: Shortcut Modification
+null more
Attack Patterns
CAPEC-132: Symlink Attack
+null more
Vendor Advisory
[GHSA-47xw-vw6m-w9fq] HashiCorp Vagrant Insecure Operation on Windows Junction / Mount Point vulnerability
GitHub Security Advisory: GHSA-47xw-vw6m-w9fq Release Date: 2023-10-28 Update Date: 2023-10-31 Severity: Low CVE-2023-5834 Base Score: 3.8 Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N Package Information Package: github.com/hashicorp/vagrant Affected Versions: Patched Versions: 2.4.0 Description HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes.
References
HCSEC-2023-31 - Vagrant’s Windows Installer Allowed Directory Junction Write
It was reported that the Vagrant Windows installer’s usage of a custom location with a non-protected path exposed the target system to unauthorized file system write, via usage of a directory junction. The Vagrant Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes.
News
[GHSA-47xw-vw6m-w9fq] HashiCorp Vagrant Insecure Operation on Windows Junction / Mount Point vulnerability
GitHub Security Advisory: GHSA-47xw-vw6m-w9fq Release Date: 2023-10-28 Update Date: 2023-10-31 Severity: Low CVE-2023-5834 Base Score: 3.8 Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N Package Information Package: github.com/hashicorp/vagrant Affected Versions: Patched Versions: 2.4.0 Description HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes.
CVE-2023-5834
Low Severity Description HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0. Read more at https://www.tenable.com/cve/CVE-2023-5834
CVE-2023-5834 | HashiCorp Vagrant up to 2.3.x on Windows Installer unknown vulnerability
A vulnerability was found in HashiCorp Vagrant up to 2.3.x on Windows. It has been classified as problematic . Affected is an unknown function of the component Installer . The manipulation leads to an unknown weakness. This vulnerability is traded as CVE-2023-5834 . The attack needs to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.
NA - CVE-2023-5834 - HashiCorp Vagrant's Windows installer...
Cvss vector : N/A Overall CVSS Score NA Base Score NA Environmental Score NA impact SubScore NA Temporal Score NA Exploitabality Sub Score NA Calculate full CVSS 3.0 Vectors scores Cvss vector : Cvss Base Score N/A Attack Range N/A Cvss Impact Score N/A Attack Complexity N/A Cvss Expoit Score N/A Authentication N/A Calculate full CVSS 2.0 Vectors scores
CVE-2023-5834
HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant...
See 5 more articles and social media posts