low3.8
CVE-2023-5834
HashiCorp Vagrant Insecure Operation on Windows Junction / Mount Point vulnerability
Impact
HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/hashicorp/vagrant | < 2.4.0 | 2.4.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hashicorp | Vagrant | before 2.4.0 |