CVE-2020-8289CWE-295

CVE-2020-8289: falha em Backblaze

Publicada em 27 dez 2020 · Atualizada em 04 ago 2024

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 4.7%

Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` helper due to hardcoded whitelist of strings in URLs where validation is disabled leading to possible remote code execution via client update functionality.

Produtos afetados

n/a · Backblaze

Referências

http://seclists.org/fulldisclosure/2020/Dec/57 http://seclists.org/fulldisclosure/2020/Dec/58 https://github.com/geffner/CVE-2020-8289/blob/master/README.md https://hackerone.com/reports/818853 https://www.backblaze.com/blog/backblaze-cloud-backup-release-7-0-1/https://youtu.be/W0THXbcX5V8