CVE-2025-46717CWE-497

sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders

Low · published May 12, 2025

CVSS v3.1
3.3
EPSS
0%
Percentile
30.1
In the wild
Unconfirmed
What it is

sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list <pathname>`. Users with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks. Version 0.2.6 fixes the vulnerability.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00374 · 30.1th percentile
Weakness
CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2025-05-12T14:52Z
EPSS history
Timeline
  • 12 MAY 14:52Z
    sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders
    cvelistv5