CVE-2017-17433 describes an access restriction bypass vulnerability in the recv_files function of rsync daemon versions 3.1.2 and 3.1.3-development. This flaw allows remote attackers to bypass intended access restrictions by performing file metadata updates before filename checks, affecting Debian and Samba distributions of rsync. The vulnerability has a CVSS score of 3.7 (LOW), indicating a network-based attack with high complexity and low impact on integrity, with no impact on confidentiality or availability. Its EPSS score is low, suggesting a minimal likelihood of exploitation. Currently, there is no evidence of active exploitation, and no public exploit code exists in Metasploit, Nuclei, or ExploitDB. While there's limited community discussion and media coverage, it is not listed on CISA's KEV catalog or any hot lists.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
7.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | ||
3.1.2CPE matchmatch criteria | cpe:2.3:a:samba:rsync:3.1.2:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.3 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.