PT-2020-18719 · Druva · Insync Client

Jimi Sebree · Published 2020-12-07 · Updated 2020-12-17 · CVE-2020-5798

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions inSync Client installer for macOS versions v6.8.0 and prior

Description The issue allows an attacker to gain privileges of a root user from a lower privileged user due to improper integrity checks and directory permissions.

Recommendations For inSync Client installer for macOS versions v6.8.0 and prior, update to a version later than v6.8.0 to resolve the issue.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-354

CWE-276

Related Identifiers

CVE-2020-5798

Affected Products

Insync Client

References · 8

• 🔥 https://tenable.com/security/research/tra-2020-67 · Exploit
• https://osv.dev/vulnerability/CVE-2020-5798 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5798 · Security Note
• https://t.me/cibsecurity/17185 · Telegram Post
• https://t.me/cvenotify/6654 · Telegram Post
• https://t.me/cybersecuritytechnologies/2308 · Telegram Post
• https://t.me/cvenotify/6722 · Telegram Post
• https://tenable.com/security/research/tra-2020-67%2Chttps://docs.druva.com/001_inSync_Cloud/Cloud/010_Release_Details/010_inSync_Cloud_Updates · Note