CVE-2018-12907

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.31%

Published

Jun 27, 2018

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to trigger the transmission of any URL's content to Google, because there is no validation of a URL field received from the Google Cloud Storage API server, aka a "RESTLESS" issue.

Weaknesses (CWE)

CWE-200

Affected Products (1)

rclone · rclonevulnerable

References (4)

http://openwall.com/lists/oss-security/2018/06/27/3

Mailing ListThird Party Advisory

https://www.danieldent.com/blog/restless-vulnerability-non-browser-cross-domain-http-request-attacks/

MitigationThird Party Advisory

http://openwall.com/lists/oss-security/2018/06/27/3

Mailing ListThird Party Advisory

https://www.danieldent.com/blog/restless-vulnerability-non-browser-cross-domain-http-request-attacks/

MitigationThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs