Threats affecting pkg:cargo/github.com/rustdesk/rustdesk

RustDesk on Windows versions before 1.5.0 does not properly enforce the one-way file transfer setting for peer clipboard file requests. This allows authenticated peers to read files from the host clipboard by sending specific messages that request clipboard file data. The vulnerability has a low severity score and does not impact integrity or availability.

RustDesk versions prior to 1.4.9 contain a missing authorization vulnerability where the server does not enforce session scope restrictions. This allows a peer with limited session permissions (such as FileTransfer, PortForward, ViewCamera, or Terminal) to send control messages and login options reserved for full Remote sessions. An authenticated remote peer can exploit this flaw to perform actions beyond their granted permissions, potentially observing and controlling the host improperly.