CVE-2023-22809: apple macos Improper Privilege Management

CVSS: 7.8v3.1HighModified

AliasesALPINE-CVE-2023-22809MGASA-2023-0025SUSE-SU-2023:0100-1+24 more

Published 18-01-2023Last modified 04-04-2025

Vulnerability summary

CVE-2023-22809 is a high (CVSS 7.8) Improper Privilege Management vulnerability in apple macos. EPSS estimates a 55.37% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities. 5 public exploits are recorded.

Overall risk

52/100

0100

High · default modelHow is this calculated?

CVSS score

7.8/10

010

High · v3.1 (CVE.org)

EPSS score

55.37%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits5reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 2 · Related 1

RHSA-2023:0859 USN-5811-1

Timeline

18-01-2023
PublishedVulnerability first disclosed.
04-04-2025
Last modifiedVulnerability information updated.

Description

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.

CVSS metrics

6 scores · 6 sources · 1 version

v3.17.8

EPSS trend

Probability

55.37%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 55.37% on 18-09-2026

18-09-202618-10-2026

EPSS score

55.37%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

5 found

referenceUnverified
Exploit Reference (synacktiv.com)
Maturity: unknown
referenceUnverified
Exploit Reference (sudo.ws)
Maturity: unknown
referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown

Show all 5 exploits

exploit-databaselocallinuxUnverified
sudo 1.8.0 to 1.9.12p1 - Privilege Escalation
Maturity: poc
MetasploitremoteVerified
Sudoedit Extra Arguments Priv Esc
exploit/linux/local/sudoedit_bypass_priv_esc
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected systems

Suse29 products

sudo&distro=SUSE Enterprise Storage 6< 1.8.27-150000.4.38.1
sudo&distro=SUSE Enterprise Storage 7< 1.8.27-150000.4.38.1
sudo&distro=SUSE Enterprise Storage 7.1< 1.9.5p2-150300.3.19.1
sudo&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 1.8.27-150000.4.38.1
sudo&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 1.8.27-150000.4.38.1

Show all 29

Redhat6 products

sudo< 0:1.8.25p1-8.el8_1.3 | < 0:1.9.5p2-7.el9_0.2 | < 0:1.9.5p2-7.el9_1.1 | < 0:1.8.29-8.el8_6.1 | < 0:1.8.29-8.el8_7.1 | < 0:1.8.6p3-29.el6_10.7 | < 0:1.8.23-10.el7_9.3 | < 0:1.8.29-5.el8_2.2 | < 0:1.8.29-7.el8_4.2 | < 0:1.8.23-3.el7_6.3 | < 0:1.8.19p2-12.el7_4.3 | < 0:1.8.23-4.el7_7.4
sudo-debuginfo< 0:1.8.25p1-8.el8_1.3 | < 0:1.9.5p2-7.el9_0.2 | < 0:1.9.5p2-7.el9_1.1 | < 0:1.8.29-8.el8_6.1 | < 0:1.8.29-8.el8_7.1 | < 0:1.8.6p3-29.el6_10.7 | < 0:1.8.23-10.el7_9.3 | < 0:1.8.29-5.el8_2.2 | < 0:1.8.29-7.el8_4.2 | < 0:1.8.23-3.el7_6.3 | < 0:1.8.19p2-12.el7_4.3 | < 0:1.8.23-4.el7_7.4
sudo-debugsource< 0:1.8.25p1-8.el8_1.3 | < 0:1.9.5p2-7.el9_0.2 | < 0:1.9.5p2-7.el9_1.1 | < 0:1.8.29-8.el8_6.1 | < 0:1.8.29-8.el8_7.1 | < 0:1.8.29-5.el8_2.2 | < 0:1.8.29-7.el8_4.2
sudo-devel< 0:1.8.6p3-29.el6_10.7 | < 0:1.8.23-10.el7_9.3 | < 0:1.8.23-3.el7_6.3 | < 0:1.8.19p2-12.el7_4.3 | < 0:1.8.23-4.el7_7.4
sudo-python-plugin< 0:1.9.5p2-7.el9_0.2 | < 0:1.9.5p2-7.el9_1.1

Show all 6

Opensuse4 products

sudo&distro=openSUSE Leap 15.4< 1.9.9-150400.4.12.1
sudo&distro=openSUSE Leap Micro 5.2< 1.9.5p2-150300.3.19.1
sudo&distro=openSUSE Leap Micro 5.3< 1.9.9-150400.4.12.1
sudo&distro=openSUSE Tumbleweed< 1.9.12p2-1.1

Debian2 products

sudo< 1.9.12p2-1 | < 1.9.5p2-3+deb11u1 | < 1.8.27-1+deb10u5
debian_linuxEOL10.0 | 11.0

Alpine1 product

sudo≥ 1.8.0, < 1.9.12_p2-r0

Apple1 product

macos< 13.4

Fedoraproject1 product

fedoraEOL36 | 37

Mageia1 product

sudo< 1.9.5p2-2.2.mga8

Sudo_project1 product

sudo≥ 1.8.0, < 1.9.12 | 1.9.12 | 1.9.12:p1

Ubuntu1 product

sudo< 1.8.21p2-3ubuntu1.5 | < 1.8.31-1ubuntu1.4 | < 1.9.9-1ubuntu2.2 | < 1.8.16-0ubuntu1.10+esm1 | < 1.8.9p5-1ubuntu1.5+esm7

10 vendors · 47 products

References

62 links

www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdfExploitMitigationTechnical DescriptionThird Party Advisory
www.sudo.ws/security/advisories/sudoedit_any/AdvisoryARTICLEExploitMitigationVendor Advisory
lists.debian.org/debian-lts-announce/2023/01/msg00012.htmlMailing ListThird Party Advisory
www.debian.org/security/2023/dsa-5321Vendor AdvisoryWEBThird Party Advisory
www.openwall.com/lists/oss-security/2023/01/19/1Mailing ListExploitThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryMailing List
security.netapp.com/advisory/ntap-20230127-0015/Third Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryMailing List
packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.htmlThird Party AdvisoryVDB Entry
security.gentoo.org/glsa/202305-12Vendor AdvisoryThird Party Advisory

Show all 62 references

support.apple.com/kb/HT213758Third Party Advisory
packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.htmlThird Party AdvisoryVDB Entry
seclists.org/fulldisclosure/2023/Aug/21Mailing ListThird Party Advisory
packetstormsecurity.com/files/…Third Party AdvisoryVDB Entry
security.alpinelinux.org/vuln/CVE-2023-22809Advisory
advisories.mageia.org/MGASA-2023-0025.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=31437REPORT
ubuntu.com/security/notices/USN-5811-1Advisory
lists.fedoraproject.org/archives/…WEB
www.suse.com/support/update/announcement/2023/suse-su-20230100-1/Advisory
bugzilla.suse.com/1207082REPORT
www.suse.com/security/cve/CVE-2023-22809WEB
www.suse.com/support/update/announcement/2023/suse-su-20230101-1/Advisory
www.suse.com/support/update/announcement/2023/suse-su-20230114-1/Advisory
www.suse.com/support/update/announcement/2023/suse-su-20230115-1/Advisory
www.suse.com/support/update/announcement/2023/suse-su-20230116-1/Advisory
bugzilla.suse.com/1206170REPORT
www.suse.com/support/update/announcement/2023/suse-su-20230117-1/Advisory
access.redhat.com/errata/RHSA-2023:0280Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2161142REPORT
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0280.jsonAdvisory
access.redhat.com/security/cve/CVE-2023-22809REPORT
www.cve.org/CVERecord?id=CVE-2023-22809AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2023-22809AdvisoryOval
github.com/sudo-project/sudo/releases/tag/SUDO_1_9_12p2ARTICLE
access.redhat.com/errata/RHSA-2023:0281Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0281.jsonAdvisory
access.redhat.com/errata/RHSA-2023:0282Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0282.jsonAdvisory
access.redhat.com/errata/RHSA-2023:0283Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0283.jsonAdvisory
access.redhat.com/errata/RHSA-2023:0284Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0284.jsonAdvisory
access.redhat.com/errata/RHSA-2023:0287Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0287.jsonAdvisory
access.redhat.com/errata/RHSA-2023:0291Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0291.jsonAdvisory
access.redhat.com/errata/RHSA-2023:0292Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0292.jsonAdvisory
access.redhat.com/errata/RHSA-2023:0293Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0293.jsonAdvisory
access.redhat.com/errata/RHSA-2023:3262Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3262.jsonAdvisory
access.redhat.com/errata/RHSA-2023:3264Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3264.jsonAdvisory
access.redhat.com/errata/RHSA-2023:3276Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3276.jsonAdvisory
ubuntu.com/security/CVE-2023-22809REPORT
ubuntu.com/security/notices/USN-5811-2Advisory
ubuntu.com/security/notices/USN-5811-3Advisory
security-tracker.debian.org/tracker/CVE-2023-22809Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities