CVE-2013-10052

Katalog CVE

CVSS 8.5 · High EPSS 0,32%

Kerentanan Improper Privilege Management. Skor CVSS 4.0 8.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

ZPanel includes a helper binary named zsudo, intended to allow restricted privilege escalation for administrative tasks. However, when misconfigured in /etc/sudoers, zsudo can be invoked by low-privileged users to execute arbitrary commands as root. This flaw enables local attackers with shell access to escalate privileges by writing a payload to a writable directory and executing it via zsudo. The vulnerability is particularly impactful in post-exploitation scenarios following web server compromise, where the attacker inherits access to zsudo.

Rincian

Terbit di NVD

4 Agustus 2025

Terakhir diubah

16 Juni 2026

Status NVD

Deferred

CVSS 4.0

8.5 (High), sumber vulncheck.com
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/zpanel/zpanelx
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/local/zpanel_zsudo...
• https://www.exploit-db.com/exploits/26451
• https://www.vulncheck.com/advisories/zpanel-zsudo-local-priv-esc