high7.8
CVE-2020-8289
Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` helper due to hardc…
Impact
Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` helper due to hardcoded whitelist of strings in URLs where validation is disabled leading to possible remote code execution via client update functionality.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Backblaze | Backblaze | before 7.0.1.433 before 7.0.1.434 |
Weakness classification
References
- NVD record
- CVE.org record
- http://seclists.org/fulldisclosure/2020/Dec/57
- http://seclists.org/fulldisclosure/2020/Dec/58
- https://github.com/geffner/CVE-2020-8289/blob/master/README.md
- https://hackerone.com/reports/818853
- https://www.backblaze.com/blog/backblaze-cloud-backup-release-7-0-1/
- https://youtu.be/W0THXbcX5V8
- http://seclists.org/fulldisclosure/2020/Dec/57
- http://seclists.org/fulldisclosure/2020/Dec/58
- https://github.com/geffner/CVE-2020-8289/blob/master/README.md
- https://hackerone.com/reports/818853
- https://www.backblaze.com/blog/backblaze-cloud-backup-release-7-0-1/
- https://youtu.be/W0THXbcX5V8