Search for vulnerabilities
Vulnerability details: VCID-pu7e-sm7k-ukdt
Vulnerability ID VCID-pu7e-sm7k-ukdt
Aliases CVE-2023-22809
Summary In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
Status Published
Exploitability 2.0
Weighted Severity 7.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-269 Improper Privilege Management
System Score Found at
cvssv3.1 7.8 http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html
ssvc Track http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html
cvssv3.1 7.8 http://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.html
ssvc Track http://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.html
cvssv3.1 7.8 http://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html
ssvc Track http://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html
cvssv3 7.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-22809.json
epss 0.42005 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.42005 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.42005 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.43244 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.43244 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.43244 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.43244 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.50157 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.50157 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.50157 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.50157 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.5074 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.5074 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.5074 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.5074 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.5074 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.5074 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.5074 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.5074 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
epss 0.5074 https://api.first.org/data/v1/epss?cve=CVE-2023-22809
cvssv3.1 7.8 http://seclists.org/fulldisclosure/2023/Aug/21
ssvc Track http://seclists.org/fulldisclosure/2023/Aug/21
cvssv3.1 7.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 7.8 https://lists.debian.org/debian-lts-announce/2023/01/msg00012.html
ssvc Track https://lists.debian.org/debian-lts-announce/2023/01/msg00012.html
cvssv3.1 7.8 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/
cvssv3.1 7.8 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/
cvssv3.1 7.8 https://nvd.nist.gov/vuln/detail/CVE-2023-22809
cvssv3.1 7.8 https://security.gentoo.org/glsa/202305-12
ssvc Track https://security.gentoo.org/glsa/202305-12
cvssv3.1 7.8 https://security.netapp.com/advisory/ntap-20230127-0015/
ssvc Track https://security.netapp.com/advisory/ntap-20230127-0015/
cvssv3.1 7.8 https://support.apple.com/kb/HT213758
ssvc Track https://support.apple.com/kb/HT213758
cvssv3.1 7.8 https://www.debian.org/security/2023/dsa-5321
ssvc Track https://www.debian.org/security/2023/dsa-5321
cvssv3.1 7.8 https://www.sudo.ws/security/advisories/sudoedit_any/
ssvc Track https://www.sudo.ws/security/advisories/sudoedit_any/
cvssv3.1 7.8 https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf
ssvc Track https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf
cvssv3.1 7.8 http://www.openwall.com/lists/oss-security/2023/01/19/1
ssvc Track http://www.openwall.com/lists/oss-security/2023/01/19/1
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-22809.json
https://api.first.org/data/v1/epss?cve=CVE-2023-22809
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22809
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1 http://www.openwall.com/lists/oss-security/2023/01/19/1
202305-12 https://security.gentoo.org/glsa/202305-12
21 http://seclists.org/fulldisclosure/2023/Aug/21
2161142 https://bugzilla.redhat.com/show_bug.cgi?id=2161142
2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/
Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html http://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html
cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
cpe:2.3:a:sudo_project:sudo:1.9.12:-:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:sudo_project:sudo:1.9.12:-:*:*:*:*:*:*
cpe:2.3:a:sudo_project:sudo:1.9.12:p1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:sudo_project:sudo:1.9.12:p1:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
CVE-2023-22809 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/local/51217.sh
CVE-2023-22809 https://nvd.nist.gov/vuln/detail/CVE-2023-22809
dsa-5321 https://www.debian.org/security/2023/dsa-5321
G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/
HT213758 https://support.apple.com/kb/HT213758
msg00012.html https://lists.debian.org/debian-lts-announce/2023/01/msg00012.html
ntap-20230127-0015 https://security.netapp.com/advisory/ntap-20230127-0015/
RHSA-2023:0280 https://access.redhat.com/errata/RHSA-2023:0280
RHSA-2023:0281 https://access.redhat.com/errata/RHSA-2023:0281
RHSA-2023:0282 https://access.redhat.com/errata/RHSA-2023:0282
RHSA-2023:0283 https://access.redhat.com/errata/RHSA-2023:0283
RHSA-2023:0284 https://access.redhat.com/errata/RHSA-2023:0284
RHSA-2023:0287 https://access.redhat.com/errata/RHSA-2023:0287
RHSA-2023:0291 https://access.redhat.com/errata/RHSA-2023:0291
RHSA-2023:0292 https://access.redhat.com/errata/RHSA-2023:0292
RHSA-2023:0293 https://access.redhat.com/errata/RHSA-2023:0293
RHSA-2023:0859 https://access.redhat.com/errata/RHSA-2023:0859
RHSA-2023:3262 https://access.redhat.com/errata/RHSA-2023:3262
RHSA-2023:3264 https://access.redhat.com/errata/RHSA-2023:3264
RHSA-2023:3276 https://access.redhat.com/errata/RHSA-2023:3276
sudo-1.9.12p1-Privilege-Escalation.html http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html
sudo-CVE-2023-22809.pdf https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf
sudoedit_any https://www.sudo.ws/security/advisories/sudoedit_any/
Sudoedit-Extra-Arguments-Privilege-Escalation.html http://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.html
USN-5811-1 https://usn.ubuntu.com/5811-1/
USN-5811-2 https://usn.ubuntu.com/5811-2/
USN-5811-3 https://usn.ubuntu.com/5811-3/
Data source Metasploit
Description This exploit takes advantage of a vulnerability in sudoedit, part of the sudo package. The sudoedit (aka sudo -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. by appending extra entries on /etc/sudoers allowing for execution of an arbitrary payload with root privileges. Affected versions are 1.8.0 through 1.9.12.p1. However THIS module only works against Ubuntu 22.04 and 22.10. This module was tested against sudo 1.9.9-1ubuntu2 on Ubuntu 22.04, and 1.9.11p3-1ubuntu1 on Ubuntu 22.10.
Note 
Stability:
  - crash-safe
Reliability:
  - repeatable-session
SideEffects:
  - ioc-in-logs
  - artifacts-on-disk
  - config-changes
Ransomware campaign use Unknown
Source publication date Jan. 18, 2023
Platform Linux
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb
Data source Exploit-DB
Date added April 3, 2023
Description sudo 1.8.0 to 1.9.12p1 - Privilege Escalation
Ransomware campaign use Unknown
Source publication date April 3, 2023
Exploit type local
Platform linux
Source update date April 3, 2023
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at http://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at http://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.html
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at http://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at http://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-22809.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at http://seclists.org/fulldisclosure/2023/Aug/21
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at http://seclists.org/fulldisclosure/2023/Aug/21
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2023/01/msg00012.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at https://lists.debian.org/debian-lts-announce/2023/01/msg00012.html
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-22809
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://security.gentoo.org/glsa/202305-12
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at https://security.gentoo.org/glsa/202305-12
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://security.netapp.com/advisory/ntap-20230127-0015/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at https://security.netapp.com/advisory/ntap-20230127-0015/
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://support.apple.com/kb/HT213758
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at https://support.apple.com/kb/HT213758
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://www.debian.org/security/2023/dsa-5321
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at https://www.debian.org/security/2023/dsa-5321
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://www.sudo.ws/security/advisories/sudoedit_any/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at https://www.sudo.ws/security/advisories/sudoedit_any/
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at http://www.openwall.com/lists/oss-security/2023/01/19/1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-04T15:43:57Z/ Found at http://www.openwall.com/lists/oss-security/2023/01/19/1
Exploit Prediction Scoring System (EPSS)
Percentile 0.97349
EPSS Score 0.42005
Published At Sept. 16, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:38:15.451957+00:00 Alpine Linux Importer Import https://secdb.alpinelinux.org/v3.14/main.json 37.0.0