CVE-2023-28486

EPSS 0.1%
Published 16.03.2023 01:15:47
Last modified 21.11.2024 07:55:12
Source cve@mitre.org
Teams watchlist Login
Open Login

Sudo before 1.9.13 does not escape control characters in log messages.

Affected products Warnungen 0 Metrics 2 CWE 1 References 8

Data is provided by the National Vulnerability Database (NVD)

Sudo Project ≫ Sudo Version < 1.9.13

Netapp ≫ Active Iq Unified Manager Version- SwPlatformvmware_vsphere

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.1%	0.283

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-116 Improper Encoding or Escaping of Output

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

https://security.gentoo.org/glsa/202309-12

Third Party Advisory

https://github.com/sudo-project/sudo/commit/334daf92b31b79ce68ed75e2ee14fca265f029ca

Patch

https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_13

Release Notes

https://lists.debian.org/debian-lts-announce/2024/02/msg00002.html

https://security.netapp.com/advisory/ntap-20230420-0002/

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-28486

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-28486

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-28486

EUVD