Search for vulnerabilities
Vulnerability details: VCID-snu9-478q-aaaj
Vulnerability ID VCID-snu9-478q-aaaj
Aliases CVE-2004-0426
Summary rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, which allows remote attackers to write files outside of the module's path.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
rhas Important https://access.redhat.com/errata/RHSA-2004:192
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02009 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02351 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02351 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02351 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.02351 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.03157 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.03157 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.03157 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.03157 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.03157 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.03157 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.03157 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.03157 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.03157 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.03157 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.03157 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
epss 0.0371 https://api.first.org/data/v1/epss?cve=CVE-2004-0426
rhbs high https://bugzilla.redhat.com/show_bug.cgi?id=1617206
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2004-0426
Reference id Reference type URL
http://marc.info/?l=bugtraq&m=108515912212018&w=2
http://rsync.samba.org/
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2004-0426.json
https://api.first.org/data/v1/epss?cve=CVE-2004-0426
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0426
http://secunia.com/advisories/11514
http://secunia.com/advisories/11515
http://secunia.com/advisories/11523
http://secunia.com/advisories/11537
http://secunia.com/advisories/11583
http://secunia.com/advisories/11669
http://secunia.com/advisories/11688
http://secunia.com/advisories/11993
http://secunia.com/advisories/12054
https://exchange.xforce.ibmcloud.com/vulnerabilities/16014
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9495
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A967
http://www.ciac.org/ciac/bulletins/o-134.shtml
http://www.ciac.org/ciac/bulletins/o-212.shtml
http://www.debian.org/security/2004/dsa-499
http://www.gentoo.org/security/en/glsa/glsa-200407-10.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2004:042
http://www.redhat.com/support/errata/RHSA-2004-192.html
http://www.securityfocus.com/bid/10247
http://www.slackware.org/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.403462
http://www.trustix.net/errata/misc/2004/TSL-2004-0024-rsync.asc.txt
1617206 https://bugzilla.redhat.com/show_bug.cgi?id=1617206
cpe:2.3:a:andrew_tridgell:rsync:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:andrew_tridgell:rsync:*:*:*:*:*:*:*:*
CVE-2004-0426 https://nvd.nist.gov/vuln/detail/CVE-2004-0426
RHSA-2004:192 https://access.redhat.com/errata/RHSA-2004:192
No exploits are available.
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2004-0426
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Exploit Prediction Scoring System (EPSS)
Percentile 0.8211
EPSS Score 0.02009
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.