CVE-2019-11552

Code42 Enterprise and Crashplan for Small Business Client version 6.7 before 6.7.5, 6.8 before 6.8.8, and 6.9 before 6.9.4 allows eval injection. A proxy auto-configuration file, crafted by a lesser privileged user, may be used to execute arbitrary code at a higher privilege as the service user.

CVSS v3.1

7.0 HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

4.4 MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.55% chance of exploitation in the next 30 days, 44th percentile

Published

2019-07-19

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://bordplate.no/blog/en/post/crashplan-privilege-escalation/

References

• CVE Record
• NVD entry

Related

• CVE-2019-11549
• CVE-2019-11557
• CVE-2019-11542
• CVE-2019-11564
• CVE-2019-11540
• CVE-2019-11565