[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnPlDahE5Awi8_JvMZT-M3KaM_GXe4wibTfIXkGedu2E":3,"g5a-risk:CVE-2019-25017":105},{"success":4,"data":5,"meta":103},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":38,"epssPercentile":26,"epssTimeSeries":39,"severity":40,"affectedProducts":41,"affectedProductsCount":47,"references":48,"referencesCount":47,"weaknesses":56,"weaknessesCount":47,"isActivelyExploited":65,"cisaInfo":26,"otxData":26,"relatedBlogPosts":66,"seoMetadata":67,"configurations":92,"relatedVendorCves":101,"notableEvents":102},"CVE-2019-25017","What is CVE-2019-25017?","An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files\u002Fdirectories are sent to the client. However, the rcp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious rcp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rcp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh\u002Fauthorized_keys file). This issue is similar to CVE-2019-6111 and CVE-2019-7283. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.","An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files\u002Fdire...","2021-02-02T18:15:10.937","2021-07-21T11:39:23.747",5.9,"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":26,"CVSSMetricV2":29,"CVSSMetricV40":26},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":23,"IntegrityImpact":22,"AvailabilityImpact":23,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":23,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","NETWORK","HIGH","NONE","UNCHANGED","MEDIUM",null,2.2,3.6,[30],{"Source":17,"Type":18,"CVSSData":31,"BaseSeverity":25,"ExploitabilityScore":36,"ImpactScore":37,"ACInsufInfo":26,"ObtainAllPrivilege":26,"ObtainUserPrivilege":26,"ObtainOtherPrivilege":26,"UserInteractionRequired":26},{"Version":32,"VectorString":33,"AccessVector":21,"AccessComplexity":25,"Authentication":23,"ConfidentialityImpact":23,"IntegrityImpact":34,"AvailabilityImpact":34,"BaseScore":35,"BaseSeverity":26,"Exploitability":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"CollateralDamagePotential":26,"TargetDistribution":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"EnvironmentalScore":26},"2.0","AV:N\u002FAC:M\u002FAu:N\u002FC:N\u002FI:P\u002FA:P","PARTIAL",5.8,8.6,4.9,0.01368,[38,38,38,38,38,38,38],"Medium",[42],{"vendor":43,"product":44,"version":45,"criteria":46,"vulnerable":4},"mit","krb5-appl","*","cpe:2.3:a:mit:krb5-appl:*:*:*:*:*:*:*:*",1,[49],{"url":50,"source":51,"tags":52},"https:\u002F\u002Fbugzilla.suse.com\u002Fshow_bug.cgi?id=1131109","Suse",[53,54,55],"Exploit","Issue Tracking","Third Party Advisory",[57],{"id":58,"name":59,"description":60,"extendedDescription":61,"status":62,"abstraction":63,"structure":64},"CWE-863","Incorrect Authorization","The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.","Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.\nWhen access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.","Incomplete","Class","Simple",false,[],{"title":68,"metaDescription":69,"keywords":70,"canonicalUrl":71,"structuredData":72},"What is CVE-2019-25017? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2019-25017, a medium severity cyber security vulnerability from 2021. An issue was discovered in rcp in MIT krb5-appl through 1...","CVE-2019-25017, CVE-2019-25017 vulnerability, CVE-2019-25017 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2021, CVSS score, exploit, patch, remediation, mit security, krb5-appl vulnerability","\u002Fwhat-is\u002Fcve-2019-25017",{"@context":73,"@type":74,"headline":68,"description":69,"datePublished":10,"dateModified":11,"author":75,"publisher":79,"about":83,"mainEntityOfPage":87,"articleSection":90,"keywords":91},"https:\u002F\u002Fschema.org","TechArticle",{"@type":76,"name":77,"url":78},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":76,"name":77,"url":78,"logo":80},{"@type":81,"url":82},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":84,"name":6,"description":85,"additionalType":86},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":88,"@id":89},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2019-25017","Cybersecurity","CVE-2019-25017, CVE-2019-25017 vulnerability, CVE-2019-25017 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[93],{"Operator":26,"Negate":26,"Nodes":94},[95],{"Operator":96,"Negate":26,"CPEMatch":97},"OR",[98],{"Vulnerable":4,"Criteria":46,"MatchCriteriaID":99,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":100},"BB399FFC-A7F4-491A-B6E8-7A622F7A23B5","1.0.3",[],[],{"lastModified":11,"cacheTime":104,"version":32},1792437177761,{"score":106,"band":40,"action":107,"scoredAt":108},44,"Plan remediation","2026-10-16T06:50:23.98732+00:00"]