PT-2024-16127 · Vagrant · Vagrant Vmware Utility

Farid Zerrouk + 1 · Published 2024-10-29 · Updated 2024-11-07 · CVE-2024-10228

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vagrant VMWare Utility version 1.0.23 and earlier

Description The Vagrant VMWare Utility Windows installer has a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes.

Recommendations For versions prior to 1.0.23, update to Vagrant VMWare Utility version 1.0.23 to resolve the issue.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2025-09563

CVE-2024-10228

Affected Products

Vagrant Vmware Utility

References · 9

• https://discuss.hashicorp.com/t/hcsec-2024-25-vagrant-vmware-utility-installation-files-vulnerable-to-modification-by-unprivileged-user · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10228 · Security Note
• https://bdu.fstec.ru/vul/2025-09563 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10228 · Vendor Advisory
• https://twitter.com/transilienceai/status/1852419625428103369 · Twitter Post
• https://twitter.com/transilienceai/status/1852419617488286098 · Twitter Post
• https://t.me/cvenotify/99968 · Telegram Post
• https://discuss.hashicorp.com/t/hcsec-2024-25-vagrant-vmware-utility-installation-files-vulnerable-to-modification-by-unprivileged-user/71012 · Note
• https://twitter.com/transilienceai/status/1852419608948683147 · Twitter Post