VULNERABILITY INTELLIGENCE

CVE-2014-0106

CVSS score6.6 MEDIUM
EPSS probability0.34%
CISA KEVNot currently listed
Published2014-03-11
Last modified2026-06-17
CVSS vectorAV:L/AC:M/Au:S/C:C/I:C/A:C

Description

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.

Weakness classification

  • CWE-20: Improper Input Validation

Primary references