Design/Logic Flaw

2020-12-2702:15:00

PRIOn knowledge base

www.prio-n.com

7.6 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in bztransmit helper due to lack of permission handling and validation before creation of client update directories allowing for local escalation of privilege via rogue client update binary.

CPENameOperatorVersion
backblazelt7.0.0.439
backblazelt7.0.0.439

CPE	Name	Operator	Version
	backblaze	lt	7.0.0.439
	backblaze	lt	7.0.0.439

References

github.com/geffner/CVE-2020-8290/blob/master/README.md

hackerone.com/reports/818857

youtu.be/OpC6neWd2aM