CVE-2022-42717

{"id": "CVE-2022-42717", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2022-10-11T23:15:10.237", "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2022-23-vagrant-nfs-sudoers-configuration-allows-for-local-privilege-escalation/45423", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/hashicorp/vagrant/pull/12910", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.vagrantup.com/docs/synced-folders/nfs", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://discuss.hashicorp.com/t/hcsec-2022-23-vagrant-nfs-sudoers-configuration-allows-for-local-privilege-escalation/45423", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/hashicorp/vagrant/pull/12910", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.vagrantup.com/docs/synced-folders/nfs", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root."}, {"lang": "es", "value": "Se ha detectado un problema en Hashicorp Packer versiones anteriores a 2.3.1. La configuraci\u00f3n de sudoers recomendada para Vagrant en Linux es insegura. Si el host ha sido configurado de acuerdo con esta documentaci\u00f3n, los usuarios no privilegiados en el host pueden aprovechar un comod\u00edn en la configuraci\u00f3n de sudoers para ejecutar comandos arbitrarios como root"}], "lastModified": "2024-11-21T07:25:12.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hashicorp:vagrant:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7610EDB-7BA1-4EAF-B534-06BD2BE3ABEA", "versionEndExcluding": "2.3.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}