rsync, when running in daemon mode, does not properly call setgroups before dropping privileges, which could provide supplemental group privileges to local users, who could then read certain files that would otherwise be disallowed.
AV:L/AC:L/Au:N/C:P/I:N/A:N
This vulnerability has a 0.53% probability of being exploited in the next 30 days, ranking higher than 43% of all scored CVEs.