Privilege Escalation Affecting vagrant package, versions >=0.0.0
Threat Intelligence
EPSS
0.04% (14th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-VAGRANT-3042999
- published 12 Oct 2022
- disclosed 12 Oct 2022
- credit Unknown
Introduced: 12 Oct 2022
CVE-2022-42717 Open this link in a new tabHow to fix?
A fix was pushed into the master branch but not yet published.
Overview
Affected versions of this package are vulnerable to Privilege Escalation due to the recommended sudoers configuration for Vagrant on Linux being insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.
References
CVSS Scores
version 3.1