{"id":"CVE-2024-10228","aliases":["EUVD-2024-32987","GHSA-f8cq-cpqj-phg9"],"status":"published","title":"Vagrant VMWare Utility installation files vulnerable to modification by unprivileged user","description":"The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMWare Utility 1.0.23","severity":{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00142,"percentile":0.03603,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-732"],"published":"2024-10-29T21:18:13Z","modified":"2026-10-28T02:30:45Z","products":[{"vendor":"hashicorp","product":"vagrant"},{"vendor":"hashicorp","product":"vagrant_vmware_utility"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2024-25-vagrant-vmware-utility-installation-files-vulnerable-to-modification-by-unprivileged-user","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10228","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f8cq-cpqj-phg9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10228.json","tags":["advisory"]},{"url":"https://github.com/hashicorp/vagrant-vmware-desktop","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-10228","title":"Vagrant VMWare Utility installation files vulnerable to modification by unprivileged user","description":"The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMWare Utility 1.0.23","status":"published","published":"2024-10-29T21:18:13.145Z","modified":"2024-10-30T13:25:02.816Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:34:02.652467Z"}],"euvd":[{"id":"EUVD-2024-32987","description":"The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMWare Utility 1.0.23","status":"published","published":"2024-10-29T21:18:13Z","modified":"2024-10-30T13:25:02Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T00:05:14.718275Z"}],"ghsa":[{"id":"GHSA-f8cq-cpqj-phg9","title":"The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path...","description":"The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMWare Utility 1.0.23","status":"published","published":"2024-10-30T00:31:04Z","modified":"2024-10-30T00:31:10Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:58:39.26425Z"}],"nvd":[{"id":"CVE-2024-10228","description":"The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMWare Utility 1.0.23","status":"published","published":"2024-10-29T22:15:03.22Z","modified":"2026-06-17T06:55:11.89Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:10:35.289159Z"}],"osv":[{"id":"CVE-2024-10228","title":"Vagrant VMWare Utility installation files vulnerable to modification by unprivileged user","description":"The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMWare Utility 1.0.23","status":"published","published":"2024-10-29T21:18:13.145Z","modified":"2026-10-28T02:30:45.007139132Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:44:37.180532Z"}]}}