Vulnerabilities > CVE-2019-25016 - Missing Initialization of Resource vulnerability in Opendoas Project Opendoas 6.6/6.6.1/6.8

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
SINGLE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
opendoas-project
CWE-909
NVD
Published: 2021-01-28
Updated: 2022-04-26

Summary

In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.

Vulnerable Configurations

Part Description Count
Application
Opendoas_Project
3

Common Weakness Enumeration (CWE)

References