Description

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable privilege escalation and unauthorized access to critical system files, compromising system integrity, confidentiality, and availability. This vulnerability is fixed in 1.68.2.

INFO

Published Date :

2024-11-15T17:15:43.357Z

Last Modified :

2024-11-21T14:56:00.193Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2024-52522 vulnerability.

Vendors Products
Rclone
  • Rclone
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-52522.

URL Resource
https://github.com/rclone/rclone/commit/01ccf204f42b4f68541b16843292439090a2dcf0 cve-icon cve-icon cve-icon
https://github.com/rclone/rclone/security/advisories/GHSA-hrxh-9w67-g4cv cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-52522 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-52522 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact