CVEvulnerability

CVE-2025-46717

3.3 LOW Published 2025-05-12 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-05-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.3 LOW — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-497

Description

sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list <pathname>`. Users with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks. Version 0.2.6 fixes the vulnerability.

Affected configurations

• trifectatech sudo (< 0.2.6)

Related

Weakness · CWE (1)

  • CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere weakness

References