CVE-2025-46717lowCWE-497

CVE-2025-46717: fallo de gravedad baja en trifectatechfoundation sudo-rs

sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders

Publicada el

Seguir esta CVE+ Monitorear sudo-rs+ Monitorear sudo-rs

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 3.3epss 0.4%
sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list <pathname>`. Users with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks. Version 0.2.6 fixes the vulnerability.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Productos afectados
trifectatechfoundation · sudo-rs
CVEs relacionadas — trifectatechfoundation sudo-rs

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-46718LOWsudo-rs Allows Low Privilege Users to Enumerate Privileges of OthersEPSS 0.3%CVE-2025-64517MEDIUMsudo-rs doesn't record authenticating user properly in timestampEPSS 0.2%CVE-2025-64170LOWsudo-rs: Partial password reveal is possible after timeoutEPSS 0.1%