CVE-2024-12088

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-12088
A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2025:2600
https://access.redhat.com/security/cve/CVE-2024-12088
https://bugzilla.redhat.com/show_bug.cgi?id=2330676
https://kb.cert.org/vuls/id/952657
https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj
Configurations

No configuration.

History

11 Mar 2025, 04:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:2600 -

26 Feb 2025, 15:15

Type Values Removed Values Added
References
  • () https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj -

10 Feb 2025, 12:15

Type Values Removed Values Added
Summary
  • (es) Se encontró un fallo en rsync. Al usar la opción `--safe-links`, rsync no verifica correctamente si un destino de enlace simbólico contiene otro enlace simbólico dentro de él. Esto genera una vulnerabilidad de Path Traversal, que puede provocar la escritura arbitraria de archivos fuera del directorio deseado.
Summary (en) A flaw was found in rsync. When using the `--safe-links` option, rsync fails to properly verify if a symbolic link destination contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory. (en) A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.

14 Jan 2025, 22:15

Type Values Removed Values Added
References
  • () https://kb.cert.org/vuls/id/952657 -

14 Jan 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-14 18:15

Updated : 2025-03-11 04:15

NVD link : CVE-2024-12088

Mitre link : CVE-2024-12088

CVE.ORG link : CVE-2024-12088

JSON object : View

Products Affected

No product.

CWE
CWE-35

Path Traversal: '.../...//'