What is CVE-2018-20131?

CVE-2018-20131 is a high-severity vulnerability in Code42, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 7.8/10. Published 2019-01-03.

How severe is CVE-2018-20131?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Code42

CVE-2018-20131

The Code42 app before 6.8.4, as used in Code42 for Enterprise, on Linux installs with overly permissive permissions on the /usr/local/crashplan/log directory. This allows a user to manipulate symbolic links to escalate privileges, or show the contents of sensitive files that a regular user would not have access to.

EPSS: 0.003 (22.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Code42
Linux Linux_kernel
N/a — versions n/a

Weakness classification (CWE)

CWE-732 — Incorrect Permission Assignment for Critical Resource

References

cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
cve@mitre.org (x_refsource_MISC)

Frequently asked questions

What is CVE-2018-20131?: CVE-2018-20131 is a high-severity vulnerability in Code42, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 7.8/10. Published 2019-01-03.
How severe is CVE-2018-20131?: High severity. CVSS v3 base score is 7.8 out of 10.