Search for vulnerabilities
Vulnerability details: VCID-1559-zqnh-aaaa
Vulnerability ID VCID-1559-zqnh-aaaa
Aliases CVE-2023-22809
Summary In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
Status Published
Exploitability 2.0
Weighted Severity 7.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-269 Improper Privilege Management
System Score Found at
cvssv3.1 7.8 http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html
ssvc Track http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html
cvssv3.1 7.8 http://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.html
ssvc Track http://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.html
cvssv3.1 7.8 http://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html
ssvc Track http://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html
cvssv3 7.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-22809.json
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.43244 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.43244 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.43244 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.50157 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.50157 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.50157 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.50157 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.50157 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.50157 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.50157 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.50157 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.50157 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.50157 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.50157 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.50157 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.5074 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.5074 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.5074 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.5074 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.5074 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.5074 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.5074 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54063 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.54631 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.58982 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
cvssv3.1 7.8 http://seclists.org/fulldisclosure/2023/Aug/21
ssvc Track http://seclists.org/fulldisclosure/2023/Aug/21
cvssv3.1 7.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 7.8 https://lists.debian.org/debian-lts-announce/2023/01/msg00012.html
ssvc Track https://lists.debian.org/debian-lts-announce/2023/01/msg00012.html
cvssv3.1 7.8 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/
cvssv3.1 7.8 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/
cvssv3 7.8 https://nvd.nist.gov/vuln/detail/CVE-2023-22809
cvssv3.1 7.8 https://nvd.nist.gov/vuln/detail/CVE-2023-22809
cvssv3.1 7.8 https://security.gentoo.org/glsa/202305-12
ssvc Track https://security.gentoo.org/glsa/202305-12
cvssv3.1 7.8 https://security.netapp.com/advisory/ntap-20230127-0015/
ssvc Track https://security.netapp.com/advisory/ntap-20230127-0015/
cvssv3.1 7.8 https://support.apple.com/kb/HT213758
ssvc Track https://support.apple.com/kb/HT213758
cvssv3.1 7.8 https://www.debian.org/security/2023/dsa-5321
ssvc Track https://www.debian.org/security/2023/dsa-5321
cvssv3.1 7.8 https://www.sudo.ws/security/advisories/sudoedit_any/
ssvc Track https://www.sudo.ws/security/advisories/sudoedit_any/
cvssv3.1 7.8 https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf
ssvc Track https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf
cvssv3.1 7.8 http://www.openwall.com/lists/oss-security/2023/01/19/1
ssvc Track http://www.openwall.com/lists/oss-security/2023/01/19/1
Reference id Reference type URL
http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html
http://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.html
http://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-22809.json
https://api.first.org/data/v1/epss?cve=CVE-2023-22809
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22809
http://seclists.org/fulldisclosure/2023/Aug/21
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://lists.debian.org/debian-lts-announce/2023/01/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/
https://security.gentoo.org/glsa/202305-12
https://security.netapp.com/advisory/ntap-20230127-0015/
https://support.apple.com/kb/HT213758
https://www.debian.org/security/2023/dsa-5321
https://www.sudo.ws/security/advisories/sudoedit_any/
https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf
http://www.openwall.com/lists/oss-security/2023/01/19/1
2161142 https://bugzilla.redhat.com/show_bug.cgi?id=2161142
cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
cpe:2.3:a:sudo_project:sudo:1.9.12:-:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:sudo_project:sudo:1.9.12:-:*:*:*:*:*:*
cpe:2.3:a:sudo_project:sudo:1.9.12:p1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:sudo_project:sudo:1.9.12:p1:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
CVE-2023-22809 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/local/51217.sh
CVE-2023-22809 https://nvd.nist.gov/vuln/detail/CVE-2023-22809
RHSA-2023:0280 https://access.redhat.com/errata/RHSA-2023:0280
RHSA-2023:0281 https://access.redhat.com/errata/RHSA-2023:0281
RHSA-2023:0282 https://access.redhat.com/errata/RHSA-2023:0282
RHSA-2023:0283 https://access.redhat.com/errata/RHSA-2023:0283
RHSA-2023:0284 https://access.redhat.com/errata/RHSA-2023:0284
RHSA-2023:0287 https://access.redhat.com/errata/RHSA-2023:0287
RHSA-2023:0291 https://access.redhat.com/errata/RHSA-2023:0291
RHSA-2023:0292 https://access.redhat.com/errata/RHSA-2023:0292
RHSA-2023:0293 https://access.redhat.com/errata/RHSA-2023:0293
RHSA-2023:0859 https://access.redhat.com/errata/RHSA-2023:0859
RHSA-2023:3262 https://access.redhat.com/errata/RHSA-2023:3262
RHSA-2023:3264 https://access.redhat.com/errata/RHSA-2023:3264
RHSA-2023:3276 https://access.redhat.com/errata/RHSA-2023:3276
USN-5811-1 https://usn.ubuntu.com/5811-1/
USN-5811-2 https://usn.ubuntu.com/5811-2/
USN-5811-3 https://usn.ubuntu.com/5811-3/
Data source Metasploit
Description This exploit takes advantage of a vulnerability in sudoedit, part of the sudo package. The sudoedit (aka sudo -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. by appending extra entries on /etc/sudoers allowing for execution of an arbitrary payload with root privileges. Affected versions are 1.8.0 through 1.9.12.p1. However THIS module only works against Ubuntu 22.04 and 22.10. This module was tested against sudo 1.9.9-1ubuntu2 on Ubuntu 22.04, and 1.9.11p3-1ubuntu1 on Ubuntu 22.10.
Note 
Stability:
  - crash-safe
Reliability:
  - repeatable-session
SideEffects:
  - ioc-in-logs
  - artifacts-on-disk
  - config-changes
Ransomware campaign use Unknown
Source publication date Jan. 18, 2023
Platform Linux
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb
Data source Exploit-DB
Date added April 3, 2023
Description sudo 1.8.0 to 1.9.12p1 - Privilege Escalation
Ransomware campaign use Unknown
Source publication date April 3, 2023
Exploit type local
Platform linux
Source update date April 3, 2023
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at http://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at http://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.html
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at http://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at http://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-22809.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at http://seclists.org/fulldisclosure/2023/Aug/21
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at http://seclists.org/fulldisclosure/2023/Aug/21
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2023/01/msg00012.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at https://lists.debian.org/debian-lts-announce/2023/01/msg00012.html
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-22809
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-22809
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://security.gentoo.org/glsa/202305-12
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at https://security.gentoo.org/glsa/202305-12
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://security.netapp.com/advisory/ntap-20230127-0015/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at https://security.netapp.com/advisory/ntap-20230127-0015/
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://support.apple.com/kb/HT213758
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at https://support.apple.com/kb/HT213758
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://www.debian.org/security/2023/dsa-5321
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at https://www.debian.org/security/2023/dsa-5321
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://www.sudo.ws/security/advisories/sudoedit_any/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at https://www.sudo.ws/security/advisories/sudoedit_any/
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at http://www.openwall.com/lists/oss-security/2023/01/19/1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at http://www.openwall.com/lists/oss-security/2023/01/19/1
Exploit Prediction Scoring System (EPSS)
Percentile 0.20796
EPSS Score 0.00050
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.