CVE-2020-8289

2020-12-2701:20:50

CWE-295

hackerone

www.cve.org

backblaze

windows

macos

certificate validation

remote code execution

client update functionality

EPSS

0.012

Percentile

85.6%

JSON

Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in bztransmit helper due to hardcoded whitelist of strings in URLs where validation is disabled leading to possible remote code execution via client update functionality.

CNA Affected

[
  {
    "product": "Backblaze",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434"
      }
    ]
  }
]