CVE-2013-10052

216.73.217.47

· Published 04/08/2025 18:15 · Modified 05/08/2025 16:15

Labels: CVE-2013-10052 2025-08-04 CVE-2013-10052 CWE-269 [email protected]

Essential information

Published: 04/08/2025 18:15
Modified: 05/08/2025 16:15
Author: —
Creator: —
CVSS: 8.5 HIGH (v3) 8.5 HIGH (v4.0)
CISA KEV: No
CWE: —
CVSS vector: —

CVSS metrics

Description

ZPanel includes a helper binary named zsudo, intended to allow restricted privilege escalation for administrative tasks. However, when misconfigured in /etc/sudoers, zsudo can be invoked by low-privileged users to execute arbitrary commands as root. This flaw enables local attackers with shell access to escalate privileges by writing a payload to a writable directory and executing it via zsudo. The vulnerability is particularly impactful in post-exploitation scenarios following web server compromise, where the attacker inherits access to zsudo.

NVD status

Status: Awaiting Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
zpanel / zpanel	`cpe:2.3:a:zpanel:zpanel::::::::`