60
CVE-2024-12088
—CVSS 3.1
7.5 high
EPSS
5%p91
Published
()
Modified
Description
A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
- Vendors
- sambaredhatarchlinuxgentoonixosnovelltritondatacenteralmalinux
- Products
- rsync, discovery, openshift container platform, enterprise linux, enterprise linux eus, enterprise linux for arm 64, enterprise linux for arm 64 eus, enterprise linux for ibm z systems, enterprise linux for ibm z systems eus, enterprise linux for power little endian, enterprise linux for power little endian eus, enterprise linux server aus
- Weakness
- CWE-22
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N