VULNERABILITY INTELLIGENCE

CVE-2018-12907

CVSS score7.5 HIGH

EPSS probability1.31%

CISA KEVNot currently listed

Published2018-06-27

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to trigger the transmission of any URL's content to Google, because there is no validation of a URL field received from the Google Cloud Storage API server, aka a "RESTLESS" issue.

Weakness classification

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references

cve@mitre.org — Mailing List, Third Party Advisory
cve@mitre.org — Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Third Party Advisory