CVEvulnerability
CVE-2020-15850
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-09-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-276
Description
Insecure permissions in Nakivo Backup & Replication Director version 9.4.0.r43656 on Linux allow local users to access the Nakivo Director web interface and gain root privileges. This occurs because the database containing the users of the web application and the password-recovery secret value is readable.
Affected configurations
• nakivo backup \& replication director 9.4.0.r43656
Related
Weakness · CWE (1)
- CWE-276 Incorrect Default Permissions weakness
References
- https://helpcenter.nakivo.com/display/RN/v10.3+Release+Notes Release Notes, Vendor Advisory
- https://labs.f-secure.com/advisories/nakivo-backup-and-replication-multiple-vulnerabilities Exploit, Third Party Advisory
- https://helpcenter.nakivo.com/display/RN/v10.3+Release+Notes Release Notes, Vendor Advisory
- https://labs.f-secure.com/advisories/nakivo-backup-and-replication-multiple-vulnerabilities Exploit, Third Party Advisory