CVE-2025-46717lowCWE-497

CVE-2025-46717: falha de baixa gravidade em trifectatechfoundation sudo-rs

sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders

Publicada em

Seguir esta CVE+ Monitorar sudo-rs+ Monitorar sudo-rs

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.3epss 0.4%
sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list <pathname>`. Users with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks. Version 0.2.6 fixes the vulnerability.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
trifectatechfoundation · sudo-rs
CVEs relacionadas — trifectatechfoundation sudo-rs

No mesmo produto, das mais perigosas para as menos.

CVE-2025-46718LOWsudo-rs Allows Low Privilege Users to Enumerate Privileges of OthersEPSS 0.3%CVE-2025-64517MEDIUMsudo-rs doesn't record authenticating user properly in timestampEPSS 0.2%CVE-2025-64170LOWsudo-rs: Partial password reveal is possible after timeoutEPSS 0.1%