CVE-2023-22809

🗓️ 18 Jan 2023 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 1342 Views🌐 WEB

Sudo before 1.9.12p2 mishandles user-provided environment variables, leading to privilege escalatio

Reporter	Title	Published	Views	Family All 290
zdt	sudo 1.8.0 to 1.9.12p1 - Privilege Escalation Exploit	3 Apr 202300:00	–	zdt
zdt	Sudoedit Extra Arguments Privilege Escalation Exploit	23 May 202300:00	–	zdt
zdt	Cisco ThousandEyes Enterprise Agent Virtual Appliance Arbitrary File Modification Vulnerability	20 Aug 202300:00	–	zdt
GithubExploit	Exploit for Improper Privilege Management in Sudo_Project Sudo	30 Jul 202509:48	–	githubexploit
GithubExploit	Exploit for Improper Privilege Management in Sudo_Project Sudo	10 Jul 202306:38	–	githubexploit
GithubExploit	Exploit for Improper Privilege Management in Sudo_Project Sudo	28 Aug 202414:22	–	githubexploit
GithubExploit	Exploit for Improper Privilege Management in Sudo_Project Sudo	6 Aug 202306:46	–	githubexploit
GithubExploit	Exploit for Improper Privilege Management in Sudo_Project Sudo	6 Apr 202303:11	–	githubexploit
GithubExploit	Exploit for Improper Privilege Management in Sudo_Project Sudo	6 Apr 202303:11	–	githubexploit
GithubExploit	Exploit for Improper Privilege Management in Sudo_Project Sudo	20 Jun 202300:38	–	githubexploit

NVD

Node

sudo_project sudoRange1.8.0–1.9.12

Node

Node

Node

apple macosRange<13.4

Source	Link
debian	www.debian.org/security/2023/dsa-5321
packetstormsecurity	www.packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html
synacktiv	www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf
security	www.security.netapp.com/advisory/ntap-20230127-0015/
packetstormsecurity	www.packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.html
openwall	www.openwall.com/lists/oss-security/2023/01/19/1
sudo	www.sudo.ws/security/advisories/sudoedit_any/
security	www.security.gentoo.org/glsa/202305-12
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/
lists	www.lists.debian.org/debian-lts-announce/2023/01/msg00012.html

Parameter	Position	Path	Description	CWE
EDITOR	path	/etc/sudoers	Sudoedit vulnerability allows editing /etc/sudoers via editor injection	CWE-269
SUDO_EDITOR	path	/etc/sudoers	Sudoedit vulnerability allows editing /etc/sudoers via editor injection	CWE-269
VISUAL	path	/etc/sudoers	Sudoedit vulnerability allows editing /etc/sudoers via editor injection	CWE-269
EDITOR	path	/etc/hosts	Sudoedit can modify arbitrary files including /etc/hosts using editor injection	CWE-269
SUDO_EDITOR	path	/etc/hosts	Sudoedit can modify arbitrary files including /etc/hosts using editor injection	CWE-269
VISUAL	path	/etc/hosts	Sudoedit can modify arbitrary files including /etc/hosts using editor injection	CWE-269

17 Jun 2026 05:36Current

7.7High risk

Vulners AI Score7.7

CVSS 3.17.8

EPSS0.55367

SSVC