CVE-2024-12088

Katalog CVE

CVSS 7.5 · High EPSS 4,7%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada samba rsync, redhat discovery +18 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.

Rincian

Terbit di NVD

14 Januari 2025

Terakhir diubah

30 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

4,7% peluang dieksploitasi; lebih tinggi dari 91,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2025:2600 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2025:7050 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2025:8385 advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2024-12088 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2330676 issue tracking · advisory pihak ketiga
• https://kb.cert.org/vuls/id/952657 advisory pihak ketiga
• https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj advisory pihak ketiga
• https://access.redhat.com/errata/RHBA-2025:6470
• https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html
• https://security.netapp.com/advisory/ntap-20250131-0002/
• https://www.kb.cert.org/vuls/id/952657