CVE-2020-8289
- State
- Published
- Severity
- Not scored
- Published
- Dec 27, 2020
- Updated
- Aug 4, 2024
- Reserved
- Jan 28, 2020
Description
Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` helper due to hardcoded whitelist of strings in URLs where validation is disabled leading to possible remote code execution via client update functionality.
Scores
The record has no CVSS score.
Weaknesses
- CWE-295 Improper Certificate Validation (CWE-295)
Affected Products
| Product | Versions |
|---|---|
Backblazen/a |
|
References
- https://hackerone.com/reports/818853
- https://youtu.be/W0THXbcX5V8
- https://github.com/geffner/CVE-2020-8289/blob/master/README.md
- https://www.backblaze.com/blog/backblaze-cloud-backup-release-7-0-1/
- 20201229 Re: [FD] CVE-2020-8150 - Remote Code Execution as SYSTEM/root via Backblazemailing-list
- 20201229 Re: CVE-2020-8150 - Remote Code Execution as SYSTEM/root via Backblazemailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.