CVE-2018-20131 Path traversal in n/a

High 7.8 Published 3 Jan 2019 Updated 5 Aug 2024

A local attacker can exploit overly permissive log directory permissions to manipulate symbolic links, leading to privilege escalation or sensitive file disclosure.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-20131?

CVE-2018-20131 is a high-severity path traversal vulnerability in n/a, published on 3 Jan 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The Code42 app before 6.8.4, as used in Code42 for Enterprise, on Linux installs with overly permissive permissions on the /usr/local/crashplan/log directory. This allows a user to manipulate symbolic links to escalate privileges, or show the contents of sensitive files that a regular user would not have access to.

Weakness: CWE-732

Which versions are affected by CVE-2018-20131?

It affects 1 product.

Products include Code42 Code42.

How do I fix CVE-2018-20131?

No fix has been published for CVE-2018-20131 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2018-20131 being exploited?

There is no known exploitation of CVE-2018-20131 in the wild and no public exploit code.

Sources

Also known as GHSA-jwf9-5w8m-wgf7.