Vulnerabilities > CVE-2019-25016 - Missing Initialization of Resource vulnerability in Opendoas Project Opendoas 6.6/6.6.1/6.8

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
opendoas-project
CWE-909
NVD
Published: 2021-01-28
Updated: 2024-11-21

Summary

In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.

Vulnerable Configurations

Part Description Count
Application
Opendoas_Project
3

Common Weakness Enumeration (CWE)

References