CVE-2025-46718

Katalog CVE

CVSS 3.3 · Low EPSS 0,27%

Kerentanan Exposure of Sensitive System Information to an Unauthorized Control Sphere pada trifectatech sudo. Skor CVSS 3.1 3.3 (Low) menurut github.com.

Deskripsi (NVD)

sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with limited sudo privileges (e.g. execution of a single command) can list sudo privileges of other users using the `-U` flag. This vulnerability allows users with limited sudo privileges to enumerate the sudoers file, revealing sensitive information about other users' permissions. Attackers can collect information that can be used to more targeted attacks. Systems where users either do not have sudo privileges or have the ability to run all commands as root through sudo (the default configuration on most systems) are not affected by this advisory. Version 0.2.6 fixes the vulnerability.

Rincian

Terbit di NVD

12 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.3 (Low), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 18,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-w9q3-g4p5-5q2r exploit · advisory vendor
• https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.6 release notes