[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZKtDICKKiQMAjMU_8q6Np-Ee16TJFmmjDaKZxSwckw0":3,"g5a-risk:CVE-2023-5834":110},{"success":4,"data":5,"meta":107},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":38,"epssPercentile":26,"epssTimeSeries":39,"severity":40,"affectedProducts":41,"affectedProductsCount":47,"references":48,"referencesCount":47,"weaknesses":54,"weaknessesCount":36,"isActivelyExploited":69,"cisaInfo":26,"otxData":26,"relatedBlogPosts":70,"seoMetadata":71,"configurations":96,"relatedVendorCves":105,"notableEvents":106},"CVE-2023-5834","What is CVE-2023-5834?","HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0.","HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized f...","2023-10-27T22:15:09.163","2023-11-13T14:34:59.287",7.8,"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":26,"CVSSMetricV2":26,"CVSSMetricV40":26},[16,29],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":22,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":25,"IntegrityImpact":25,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":25,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","LOCAL","LOW","NONE","UNCHANGED","HIGH",null,1.8,5.9,{"Source":30,"Type":31,"CVSSData":32,"ExploitabilityScore":36,"ImpactScore":37},"security@hashicorp.com","Secondary",{"Version":20,"VectorString":33,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":22,"UserInteraction":23,"Scope":34,"ConfidentialityImpact":23,"IntegrityImpact":22,"AvailabilityImpact":23,"BaseScore":35,"BaseSeverity":22,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":23,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:N\u002FI:L\u002FA:N","CHANGED",3.8,2,1.4,0.00223,[38,38,38,38,38,38,38],"High",[42],{"vendor":43,"product":44,"version":45,"criteria":46,"vulnerable":4},"hashicorp","vagrant","*","cpe:2.3:a:hashicorp:vagrant:*:*:*:*:*:*:*:*",1,[49],{"url":50,"source":51,"tags":52},"https:\u002F\u002Fdiscuss.hashicorp.com\u002Ft\u002Fhcsec-2023-31-vagrant-s-windows-installer-allowed-directory-junction-write\u002F59568","Hashicorp",[53],"Vendor Advisory",[55,63],{"id":56,"name":57,"description":58,"extendedDescription":59,"status":60,"abstraction":61,"structure":62},"CWE-1386","Insecure Operation on Windows Junction \u002F Mount Point","The product opens a file or directory, but it does not properly prevent the name from being associated with a junction or mount point to a destination that is outside of the intended control sphere.","Depending on the intended action\n\t\t\t  being performed, this could allow an\n\t\t\t  attacker to cause the product to read,\n\t\t\t  write, delete, or otherwise operate on\n\t\t\t  unauthorized files.\nIn Windows, NTFS5 allows for file\n\t\t\t  system objects called reparse points.\n\t\t\t  Applications can create a hard link from one\n\t\t\t  directory to another directory, called a\n\t\t\t  junction point. They can also create a\n\t\t\t  mapping from a directory to a drive letter,\n\t\t\t  called a mount point. If a file is used by a\n\t\t\t  privileged program, but it can be replaced\n\t\t\t  with a hard link to a sensitive file (e.g.,\n\t\t\t  AUTOEXEC.BAT), an attacker could excalate\n\t\t\t  privileges. When the process opens the file,\n\t\t\t  the attacker can assume the privileges of\n\t\t\t  that process, tricking the privileged\n\t\t\t  process to read, modify, or delete the\n\t\t\t  sensitive file, preventing the program from\n\t\t\t  accurately processing data. Note that one\n\t\t\t  can also point to registries and\n\t\t\t  semaphores.","Incomplete","Base","Simple",{"id":64,"name":65,"description":66,"extendedDescription":67,"status":68,"abstraction":61,"structure":62},"CWE-59","Improper Link Resolution Before File Access ('Link Following')","The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.","","Draft",false,[],{"title":72,"metaDescription":73,"keywords":74,"canonicalUrl":75,"structuredData":76},"What is CVE-2023-5834? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2023-5834, a high severity cyber security vulnerability from 2023. HashiCorp Vagrant's Windows installer targeted a custom loca...","CVE-2023-5834, CVE-2023-5834 vulnerability, CVE-2023-5834 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2023, CVSS score, exploit, patch, remediation, hashicorp security, vagrant vulnerability","\u002Fwhat-is\u002Fcve-2023-5834",{"@context":77,"@type":78,"headline":72,"description":73,"datePublished":10,"dateModified":11,"author":79,"publisher":83,"about":87,"mainEntityOfPage":91,"articleSection":94,"keywords":95},"https:\u002F\u002Fschema.org","TechArticle",{"@type":80,"name":81,"url":82},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":80,"name":81,"url":82,"logo":84},{"@type":85,"url":86},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":88,"name":6,"description":89,"additionalType":90},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":92,"@id":93},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2023-5834","Cybersecurity","CVE-2023-5834, CVE-2023-5834 vulnerability, CVE-2023-5834 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[97],{"Operator":26,"Negate":26,"Nodes":98},[99],{"Operator":100,"Negate":26,"CPEMatch":101},"OR",[102],{"Vulnerable":4,"Criteria":46,"MatchCriteriaID":103,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":104,"VersionEndIncluding":26},"3ADD2BC9-1919-4EB9-B23C-783DE3BD08F3","2.4.0",[],[],{"lastModified":11,"cacheTime":108,"version":109},1792439805551,"2.0",{"score":111,"band":112,"action":113,"scoredAt":114},45,"Medium","Plan remediation","2026-10-16T06:59:37.609186+00:00"]