Description
In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.
Scores
CVSS v3
8.8
EPSS
0.0102
EPSS Percentile
77.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-909
CWE-459
Status
published
Products (1)
opendoas_project/opendoas
6.6 - 6.8
Published
Jan 28, 2021
Tracked Since
Feb 18, 2026