Description
The Code42 app before 6.8.4, as used in Code42 for Enterprise, on Linux installs with overly permissive permissions on the /usr/local/crashplan/log directory. This allows a user to manipulate symbolic links to escalate privileges, or show the contents of sensitive files that a regular user would not have access to.
References (2)
Core 2
Core References
Various Sources x_refsource_misc
https://code42.com/r/support/CVE-2018-20131
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/106452
Scores
CVSS v3
7.8
EPSS
0.0004
EPSS Percentile
12.3%
Attack Vector
LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-732
Status
published
Products (1)
code42/code42
< 6.8.4
Published
Jan 03, 2019
Tracked Since
Feb 18, 2026