CVE-2019-25016

PoC —

CVSS 3.1

8.8 high

EPSS

3%p85

Published

Jan 28, 2021 (Jan 28, 2021)

Modified

Jun 17, 2026

Description

In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.

Vendors: opendoas project
Products: opendoas
Weakness: CWE-459, CWE-909
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.7%)

In the news0 stories

No ingested article mentions this CVE yet.