Description (CNA)
Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit` helper due to lack of permission handling and validation before creation of client update directories allowing for local escalation of privilege via rogue client update binary.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / Backblaze | affected Prior to 7.0.0.439 |
CWE
CWE-269
References
- https://hackerone.com/reports/818857
- https://youtu.be/OpC6neWd2aM
- https://github.com/geffner/CVE-2020-8290/blob/master/README.md
ADP enrichment
No English description supplied.