CVE-2019-25016

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-459 CWE-909

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Duncaen/OpenDoas/commit/01c658f8c45cb92a343be5f32aa6da70b2032168Patch, Third Party Advisory
https://github.com/Duncaen/OpenDoas/commit/d5acd52e2a15c36a8e06f9103d35622933aa422dPatch, Third Party Advisory
https://github.com/Duncaen/OpenDoas/issues/45Exploit, Issue Tracking, Third Party Advisory
https://github.com/Duncaen/OpenDoas/releases/tag/v6.8.1Release Notes, Third Party Advisory
https://security.gentoo.org/glsa/202107-11Third Party Advisory
https://github.com/Duncaen/OpenDoas/commit/01c658f8c45cb92a343be5f32aa6da70b2032168Patch, Third Party Advisory
https://github.com/Duncaen/OpenDoas/commit/d5acd52e2a15c36a8e06f9103d35622933aa422dPatch, Third Party Advisory
https://github.com/Duncaen/OpenDoas/issues/45Exploit, Issue Tracking, Third Party Advisory
https://github.com/Duncaen/OpenDoas/releases/tag/v6.8.1Release Notes, Third Party Advisory
https://security.gentoo.org/glsa/202107-11Third Party Advisory

Timeline

Published: Jan 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-250175.9An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses CVE-2019-250187.5In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an em CVE-2019-250199.8LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model.CVE-2019-25024.9Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.13 and prio CVE-2019-250207.5An issue was discovered in Scytl sVote 2.1. Because the sdm-ws-rest API does not require authentication, an attacker can retrieve the admini CVE-2019-250217.5An issue was discovered in Scytl sVote 2.1. Due to the implementation of the database manager, an attacker can access the OrientDB by provid CVE-2019-250229.8An issue was discovered in Scytl sVote 2.1. An attacker can inject code that gets executed by creating an election-event and injecting a pay CVE-2019-250236.5An issue was discovered in Scytl sVote 2.1. Because the IP address from an X-Forwarded-For header (which can be manipulated client-side) is CVE-2019-250249.8OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajax_system.php post_servic CVE-2019-250255.3The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time appr CVE-2019-250265.3Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting.CVE-2019-250276.1Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 throug