How severe is CVE-1999-0473?

CVE-1999-0473 has a CVSS 2.0 base score of 2.1, rated low severity.

Is CVE-1999-0473 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-1999-0473?

CVE-1999-0473 affects Andrew Tridgell Rsync. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-1999-0473?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-1999-0473 published?

CVE-1999-0473 was published on 1999-04-07 and last updated on 2026-06-16.

CVE-1999-0473

CVE-1999-0473 is a low-severity vulnerability in Andrew Tridgell Rsync with a CVSS 2.0 base score of 2.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Low (CVSS 2.0 base score 2.1)
EPSS exploit prediction: 0% (24th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Andrew Tridgell Rsync
Published: 1999-04-07
Last modified: 2026-06-16

Description

The rsync command before rsync 2.3.1 may inadvertently change the permissions of the client's working directory to the permissions of the directory being transferred.

Frequently asked questions

What is CVE-1999-0473?: The rsync command before rsync 2.3.1 may inadvertently change the permissions of the client's working directory to the permissions of the directory being transferred.
How severe is CVE-1999-0473?: CVE-1999-0473 has a CVSS 2.0 base score of 2.1, rated low severity.
Is CVE-1999-0473 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-1999-0473?: CVE-1999-0473 affects Andrew Tridgell Rsync. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-1999-0473?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-1999-0473 published?: CVE-1999-0473 was published on 1999-04-07 and last updated on 2026-06-16.

References

http://www.securityfocus.com/bid/145

Affected products (1)

cpe:2.3:a:andrew_tridgell:rsync:*:*:*:*:*:*:*:*

More vulnerabilities in Andrew Tridgell Rsync

CVE-2002-0048 — Critical (CVSS 10.0): Multiple signedness errors (mixed signed and unsigned numbers) in the I/O functions of rsync 2.4.6, 2.3.2, and other…
CVE-2006-2083 — High (CVSS 7.5): Integer overflow in the receive_xattr function in the extended attributes patch (xattr.c) for rsync before 2.6.8 might…
CVE-2003-0962 — High (CVSS 7.5): Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute…
CVE-2004-0792 — Medium (CVSS 6.4): Directory traversal vulnerability in the sanitize_path function in util.c for rsync 2.6.2 and earlier, when chroot is…
CVE-2004-0426 — Medium (CVSS 5.0): rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, which allows…

All CVEs affecting Andrew Tridgell Rsync →