Description
Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit` helper due to lack of permission handling and validation before creation of client update directories allowing for local escalation of privilege via rogue client update binary.
Exploits (1)
References (3)
Core 3
Core References
Permissions Required x_refsource_misc
https://hackerone.com/reports/818857
Exploit, Third Party Advisory x_refsource_misc
https://youtu.be/OpC6neWd2aM
Exploit, Third Party Advisory x_refsource_misc
https://github.com/geffner/CVE-2020-8290/blob/master/README.md
Scores
CVSS v3
7.8
EPSS
0.0012
EPSS Percentile
30.0%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-269
Status
published
Products (1)
backblaze/backblaze
< 7.0.0.439 (2 CPE variants)
Published
Dec 27, 2020
Tracked Since
Feb 18, 2026