CVE-2020-8290

Published: 27/12/2020 Updated: 31/12/2020

CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 410

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Backblaze for Windows and Backblaze for macOS prior to 7.0.0.439 suffer from improper privilege management in `bztransmit` helper due to lack of permission handling and validation before creation of client update directories allowing for local escalation of privilege via rogue client update binary.

Vulnerable Product	Search on Vulmon	Subscribe to Product
backblaze backblaze

Thanks, Reed I've updated the GitHub repository name to reflect this change The detailed write-up can now be found at githubcom/geffner/CVE-2020-8290/blob/master/READMEmd On Tue, Dec 22, 2020 at 3:52 AM Reed Loden <reed () reedloden com> wrote: _______________________________________________ Sent through the Full Disclosure m ...

Due to a process fail, this CVE ID was accidentally reused for another vulnerability The updated CVE ID for this issue is CVE-2020-8290 We apologize to Jason and others for the inconvenience caused by this error Happy holidays, ~reed (for HackerOne) On Fri, Sep 11, 2020 at 10:16 AM Jason Geffner <geffner () gmail com> wrote: _______ ...

CVE-2020-8290 – Elevation of Privilege in Backblaze

CVE-2020-8290 – Elevation of Privilege in Backblaze Summary Name: Elevation of Privilege in Backblaze CVE: CVE-2020-8290 Discoverer: Jason Geffner Vendor: Backblaze Product: Backblaze for Windows and Backblaze for macOS Risk: High Discovery Date: 2020-03-13 Publication Data: 2020-09-09 Fixed Version: 700439 Introduction Per Wikipedia, Backblaze is "an online back

CVE-2020-8290 – Elevation of Privilege in Backblaze

CVE-2020-8290 – Elevation of Privilege in Backblaze Summary Name: Elevation of Privilege in Backblaze CVE: CVE-2020-8290 Discoverer: Jason Geffner Vendor: Backblaze Product: Backblaze for Windows and Backblaze for macOS Risk: High Discovery Date: 2020-03-13 Publication Data: 2020-09-09 Fixed Version: 700439 Introduction Per Wikipedia, Backblaze is "an online back

CWE-269 https://github.com/geffner/CVE-2020-8290/blob/master/README.md https://youtu.be/OpC6neWd2aM https://hackerone.com/reports/818857 https://nvd.nist.gov https://github.com/geffner/CVE-2020-8290 http://seclists.org/fulldisclosure/2020/Dec/53

CVE-2020-8290

Vulnerability Summary

Vulnerability Trend

Mailing Lists

Github Repositories

References

Vulmon Search

About

Products

Connect