CVE-2022-42717

An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.

• CWE-284

• https://discuss.hashicorp.com/t/hcsec-2022-23-vagrant-nfs-sudoers-configuration-allows-for-local-privilege-escalation/45423Vendor Advisory
• https://github.com/hashicorp/vagrant/pull/12910Patch, Third Party Advisory
• https://www.vagrantup.com/docs/synced-folders/nfsProduct
• https://discuss.hashicorp.com/t/hcsec-2022-23-vagrant-nfs-sudoers-configuration-allows-for-local-privilege-escalation/45423Vendor Advisory
• https://github.com/hashicorp/vagrant/pull/12910Patch, Third Party Advisory
• https://www.vagrantup.com/docs/synced-folders/nfsProduct

Published

Oct 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-42707In Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 …7.5
• CVE-2022-4271Cross-site Scripting (XSS) - Reflected in GitHub repository …5.4
• CVE-2022-42710Nice (formerly Nortek) Linear eMerge E3-Series 0.32-08f, 0.3…5.4
• CVE-2022-42711In Progress WhatsUp Gold before 22.1.0, an SNMP MIB Walker a…9.6
• CVE-2022-42715A reflected XSS vulnerability exists in REDCap before 12.04.…6.1
• CVE-2022-42716An issue was discovered in the Arm Mali GPU Kernel Driver. T…8.8
• CVE-2022-42718Incorrect default permissions in the installation folder for…7.8
• CVE-2022-42719A use-after-free in the mac80211 stack when parsing a multi-…8.8
• CVE-2022-4272A vulnerability, which was classified as critical, has been …9.8
• CVE-2022-42720Various refcounting bugs in the multi-BSS handling in the ma…7.8
• CVE-2022-42721A list management bug in BSS handling in the mac80211 stack …5.5
• CVE-2022-42722In the Linux kernel 5.8 through 5.19.x before 5.19.16, local…5.5