CVE-2022-42717

EPSS 0.06%
Published 11.10.2022 23:15:10
Last modified 20.05.2025 15:15:51
Source cve@mitre.org
Teams watchlist Login
Open Login

An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.

Affected products Warnungen 0 Metrics 3 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Hashicorp ≫ Vagrant Version < 2.3.1

Linux ≫ Linux Kernel Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.06%	0.191

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://discuss.hashicorp.com/t/hcsec-2022-23-vagrant-nfs-sudoers-configuration-allows-for-local-privilege-escalation/45423

Vendor Advisory

https://github.com/hashicorp/vagrant/pull/12910

Patch

Third Party Advisory

https://www.vagrantup.com/docs/synced-folders/nfs

Product

https://nvd.nist.gov/vuln/detail/CVE-2022-42717

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-42717

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-42717

EUVD