{"id":"CVE-2023-22809","url":"https://www.cyber-defence.io/tools/cve/CVE-2023-22809","generatedAt":"2026-11-04T23:49:51.688Z","title":"In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process.","description":"In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a \"--\" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.","published":"2023-01-18T17:15:10.000Z","lastModified":"2026-06-17T05:36:13.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-269"],"affected":["sudo project/sudo","debian/debian linux","fedoraproject/fedora","apple/macos"],"epss":{"score":0.55367,"percentile":0.99034,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2023-04-03","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":51217,"kind":"exploit","title":"sudo 1.8.0 to 1.9.12p1 - Privilege Escalation","url":"https://www.exploit-db.com/exploits/51217","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/local/51217.sh","file":"exploits/linux/local/51217.sh","published":"2023-04-03","added":"2023-04-03","updated":"2023-04-03","author":"n3m1.sys","type":"local","platform":"linux","port":null,"verified":false,"codes":["CVE-2023-22809"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 55.4%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html","tags":["Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.html","tags":["Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html","tags":["Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://seclists.org/fulldisclosure/2023/Aug/21","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2023/01/19/1","tags":["Exploit","Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00012.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/","tags":["Mailing List"],"source":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/","tags":["Mailing List"],"source":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/202305-12","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20230127-0015/","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://support.apple.com/kb/HT213758","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2023/dsa-5321","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.sudo.ws/security/advisories/sudoedit_any/","tags":["Exploit","Mitigation","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf","tags":["Exploit","Mitigation","Technical Description","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.html","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2023/Aug/21","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2023/01/19/1","tags":["Exploit","Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00012.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202305-12","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20230127-0015/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT213758","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2023/dsa-5321","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.sudo.ws/security/advisories/sudoedit_any/","tags":["Exploit","Mitigation","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf","tags":["Exploit","Mitigation","Technical Description","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-22809","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}