Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2025-12801

Опубликовано: 04 мар. 2026
Источник: nvd
CVSS3: 6.5
EPSS Низкий

Описание

A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
Конфигурация 2
cpe:2.3:a:linux-nfs:nfs-utils:-:*:*:*:*:*:*:*

EPSS

Процентиль: 3%
0.00014
Низкий

6.5 Medium

CVSS3

Дефекты

CWE-279
CWE-732

Связанные уязвимости

CVSS3: 6.5
ubuntu
около 1 месяца назад

A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.

CVSS3: 6.5
redhat
около 1 месяца назад

A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.

CVSS3: 6.5
debian
около 1 месяца назад

A vulnerability was recently discovered in the rpc.mountd daemon in th ...

rocky
28 дней назад

Moderate: nfs-utils security update

rocky
28 дней назад

Moderate: nfs-utils security update

EPSS

Процентиль: 3%
0.00014
Низкий

6.5 Medium

CVSS3

Дефекты

CWE-279
CWE-732