Low severityNVD Advisory· Published Oct 27, 2023· Updated Sep 9, 2024

Vagrant’s Windows Installer Allowed Directory Junction Write

CVE-2023-5834

Description

HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/hashicorp/vagrantGo	< 2.4.0	2.4.0

Affected products

ghsa-coords
pkg:golang/github.com/hashicorp/vagrant
Range: < 2.4.0
Hashicorp/Vagrantcpe-rescue
Range: *

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-47xw-vw6m-w9fqghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-5834ghsaADVISORY
discuss.hashicorp.com/t/hcsec-2023-31-vagrant-s-windows-installer-allowed-directory-junction-write/59568ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.065
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000