Servers and applications
CVE-2002-0080
rsync, when running in daemon mode, does not properly call setgroups before dropping privileges, which could provide supplemental group privileges to local users, who could then read certain files that would otherwise be disallowed.
- Severity
- Low 2.1
- Published
- 15 Mar 2002
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 2.5.3
- Exploit chance
- 0.5% in the next 30 daysHigher than 45% of CVEs. EPSS by FIRST, 12 Nov 2026
- Attack
- Needs local access · No login needed
- Attacker can
- Read some data
- CVSS vector
AV:L/AC:L/Au:N/C:P/I:N/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
rsyncServers and applications · cpe:a:samba:rsync |
|