CVE-2024-12087

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 6.5EPSS 2%

Published 2025-01-14Updated 2025-04-27

Media 1324

Vulnerability details

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CNAredhat

EPSS score history

Sources

9 links

PoC links are not available for guest users. Login to view them.

CVEShield The Hacker News SC Magazine NVD Analysis Bleeping Computer Bleeping Computer The Hacker News CVE Organization RedHat Vuln DB

Profile

CVSS

6.5

EPSS

Published

2025-01-14

Updated

2025-04-27

CNA

redhat

Vendors

Red Hat

5 products

CPEs

cpe:/o:redhat:enterprise_linux:10.0

cpe:/o:redhat:rhel_els:6

cpe:/o:redhat:rhel_els:7

cpe:/o:redhat:enterprise_linux:8::baseos

cpe:/o:redhat:rhel_aus:8.2::baseos

cpe:/o:redhat:rhel_aus:8.4::baseos

cpe:/o:redhat:rhel_eus_long_life:8.4::baseos

cpe:/o:redhat:rhel_aus:8.6::baseos

cpe:/o:redhat:rhel_e4s:8.6::baseos

cpe:/o:redhat:rhel_tus:8.6::baseos

cpe:/o:redhat:rhel_e4s:8.8::baseos

cpe:/o:redhat:rhel_tus:8.8::baseos

cpe:/o:redhat:enterprise_linux:9::baseos

cpe:/a:redhat:enterprise_linux:9::appstream

cpe:/o:redhat:rhel_e4s:9.0::baseos

cpe:/a:redhat:rhel_e4s:9.0::appstream

cpe:/a:redhat:rhel_e4s:9.2::appstream

cpe:/o:redhat:rhel_e4s:9.2::baseos

cpe:/o:redhat:rhel_eus:9.4::baseos

cpe:/a:redhat:rhel_eus:9.4::appstream

cpe:/a:redhat:discovery:1.14::el9

cpe:/a:redhat:openshift:4

cpe:/o:redhat:rhivos:1

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated