CVE-2023-22809

🗓️ 18 Jan 2023 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 1208 Views🌐 WEB

Sudo before 1.9.12p2 mishandles user-provided environment variables, leading to privilege escalatio

Reporter	Title	Published	Views	Family All 276
0day.today	sudo 1.8.0 to 1.9.12p1 - Privilege Escalation Exploit	3 Apr 202300:00	–	zdt
0day.today	Sudoedit Extra Arguments Privilege Escalation Exploit	23 May 202300:00	–	zdt
0day.today	Cisco ThousandEyes Enterprise Agent Virtual Appliance Arbitrary File Modification Vulnerability	20 Aug 202300:00	–	zdt
GithubExploit	Exploit for Improper Privilege Management in Sudo_Project Sudo	30 Jul 202509:48	–	githubexploit
GithubExploit	Exploit for Improper Privilege Management in Sudo_Project Sudo	10 Jul 202306:38	–	githubexploit
GithubExploit	Exploit for Improper Privilege Management in Sudo_Project Sudo	28 Aug 202414:22	–	githubexploit
GithubExploit	Exploit for Improper Privilege Management in Sudo_Project Sudo	6 Aug 202306:46	–	githubexploit
GithubExploit	Exploit for Improper Privilege Management in Sudo_Project Sudo	6 Apr 202303:11	–	githubexploit
GithubExploit	Exploit for Improper Privilege Management in Sudo_Project Sudo	6 Apr 202303:11	–	githubexploit
GithubExploit	Exploit for Improper Privilege Management in Sudo_Project Sudo	20 Jun 202300:38	–	githubexploit

NVD

Node

sudo_project sudoRange1.8.0–1.9.12

Node

Node

Node

apple macosRange<13.4

Source	Link
openwall	www.openwall.com/lists/oss-security/2023/01/19/1
packetstormsecurity	www.packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html
security	www.security.gentoo.org/glsa/202305-12
packetstormsecurity	www.packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html
synacktiv	www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf
sudo	www.sudo.ws/security/advisories/sudoedit_any/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/
lists	www.lists.debian.org/debian-lts-announce/2023/01/msg00012.html
security	www.security.netapp.com/advisory/ntap-20230127-0015/

Parameter	Position	Path	Description	CWE
SUDO_EDITOR	path	/etc/sudoers	Sudoedit vulnerability allows a user to inject entries into the sudoers file by crafting editor arguments via environment variables.	CWE-269
VISUAL	path	/etc/sudoers	Sudoedit vulnerability allows a user to inject entries into the sudoers file by crafting editor arguments via environment variables.	CWE-269
EDITOR	path	/etc/sudoers	Sudoedit vulnerability allows a user to inject entries into the sudoers file by crafting editor arguments via environment variables.	CWE-269

04 Apr 2025 16:15Current

7.7High risk

Vulners AI Score7.7

CVSS 3.17.8

EPSS0.39861

SSVC