Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2015-5602

CWE-264CWE-599 documents8 sources
Severity
7.2HIGH
EPSS
5.5%
top 9.76%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Sudo Project Sudo
Timeline
PublishedNov 17
Latest updateMay 17

Description

sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by "/home/*/*/file.txt."

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0

Affected Packages2 packages

▶Debiansudo< 1.8.15-1.1+3
▶NVDsudo_project/sudo1.8.14

🔴Vulnerability Details

3
GHSA
GHSA-cxqf-2pgv-vx9p: sudoedit in Sudo before 1↗2022-05-17
▶
OSV
CVE-2015-5602: sudoedit in Sudo before 1↗2015-11-17
▶
CVEList
CVE-2015-5602: sudoedit in Sudo before 1↗2015-11-17
▶

💥Exploits & PoCs

1
Exploit-DB
Sudo 1.8.14 (RHEL 5/6/7 / Ubuntu) - 'Sudoedit' Unauthorized Privilege Escalation↗2015-07-28
▶

📋Vendor Advisories

2
Red Hat
sudo: Unauthorized privilege escalation in sudoedit↗2015-07-23
▶
Debian
CVE-2015-5602: sudo - sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symli...↗2015
▶

💬Community

2
Bugzilla
CVE-2015-5602 sudo: Unauthorized privilege escalation in sudoedit [fedora-all]↗2015-11-03
▶
Bugzilla
CVE-2015-5602 sudo: Unauthorized privilege escalation in sudoedit↗2015-11-03
▶
CVE-2015-5602 (HIGH CVSS 7.2) | sudoedit in Sudo before 1.8.15 allo | cvebase.io