CVE-2022-42717

State: Published
Severity: 7.8 High
Published: Oct 11, 2022
Updated: May 20, 2025
Reserved: Oct 10, 2022

Description

An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/hashicorp/vagrant/pull/12910
https://www.vagrantup.com/docs/synced-folders/nfs
https://discuss.hashicorp.com/t/hcsec-2022-23-vagrant-nfs-sudoers-configuration-allows-for-local-privilege-escalation/45423

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.