CVE-2017-11741

HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.24 uses weak permissions for the sudo helper scripts, allows local users to execute arbitrary code with root privileges by overwriting one of the scripts.

CVSS v3.0 NVD

8.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0 NVD

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

1.11% chance of exploitation in the next 30 days, 65th percentile

Published

2017-08-08

Updated

2024-08-05

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/43224

Security advisories

• http://seclists.org/fulldisclosure/2017/Aug/0
• https://m4.rkw.io/blog/cve201711741-local-root-privesc-in-hashicorp-vagrantvmwarefusion--…

References

• CVE Record
• NVD entry