PT-2019-14342 · Cloudberry · Cloudberry Backup

Publicado 2019-08-28 · Atualizado 2020-08-24 · CVE-2019-15720

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CloudBerry Backup version 6.1.2.34

Description The issue allows local privilege escalation via a Pre or Post backup action. With only user-level access, a user can modify the backup plan and add a Pre backup action script that executes on behalf of NT AUTHORITYSYSTEM.

Recommendations For CloudBerry Backup version 6.1.2.34, as a temporary workaround, consider disabling the execution of Pre and Post backup action scripts until a patch is available. Restrict access to modify backup plans to minimize the risk of exploitation.

Exploit

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2019-15720

Produtos afetados

Cloudberry Backup

Referências · 3

• 🔥 https://sevenlayers.com/index.php/243-cloudberry-backup-local-privilege-escalation · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-15720 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15720 · Aviso do Fabricante