CVE-2024-10228— Vagrant VMWare Utility installation files vulnerable to modification by unprivileged user
Quick assessment
Affected
HashiCorp Vagrant
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HashiCorp Vagrant VMware Utility是美国HashiCorp公司的一个实用程序服务。 Vagrant VMWare Utility 1.0.22及之前版本存在安全漏洞，该漏洞源于Windows安装程序针对自定义位置使用了非受保护路径，这可能被未授权用户修改，从而引入未经授权的文件系统写入。
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-10228
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vagrant VMWare Utility installation files vulnerable to modification by unprivileged user
Source: CVE Program / CVE List V5
Vulnerability Description
The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMWare Utility 1.0.23
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键资源的不正确权限授予
Source: CVE Program / CVE List V5
Vulnerability Title
Vagrant VMWare Utility 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HashiCorp Vagrant VMware Utility是美国HashiCorp公司的一个实用程序服务。 Vagrant VMWare Utility 1.0.22及之前版本存在安全漏洞，该漏洞源于Windows安装程序针对自定义位置使用了非受保护路径，这可能被未授权用户修改，从而引入未经授权的文件系统写入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-10228
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-10228
请登录查看更多情报信息。
Other References for CVE-2024-10228 (1)
IV. Related Vulnerabilities
Same vendor: HashiCorp
-
CVE-2026-5006
Vault Vulnerable to Privilege Escalation via Slash Injection -
CVE-2026-14978
Unicode normalization mismatch in go-slug ignore pattern mat -
CVE-2026-19589
Packer vulnerable to arbitrary file write via crafted plugin -
CVE-2026-8715
Vault Secrets Operator vulnerable to arbitrary file read and -
CVE-2026-14886
Vault Enterprise vulnerable to cross-namespace entity deleti
Same weakness: CWE-732
-
CVE-2026-14208
Local Privilege Escalation via Insecure DLL Permissions in R -
CVE-2026-18270
Kenwood DNR1007XR udhcpd Incorrect Permission Assignment Loc -
CVE-2026-76399
Incorrect Permission Assignment for Scheduled Searches in Sp -
CVE-2026-76388
Privilege Escalation through Search Macro Permissions in Spl -
CVE-2026-76372
Incorrect Permission Assignment through Safe Mode in Nmap Sc
V. Comments for CVE-2024-10228
No comments yet