high7.8
CVE-2021-36668
URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port parameter to the Electron App.
Impact
URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port parameter to the Electron App.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Druva | Insync Client | before 5.9.3 before 7.0.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://docs.druva.com/Knowledge_Base/Security_Update/Security_Advisory_for_inSync_Client_7.0.1_and_before
- https://imhotepisinvisible.com/druva-lpe/
- https://docs.druva.com/Knowledge_Base/Security_Update/Security_Advisory_for_inSync_Client_7.0.1_and_before
- https://imhotepisinvisible.com/druva-lpe/