High severity7.8NVD Advisory· Published Jan 3, 2019· Updated Jun 17, 2026

CVE-2018-20131

Description

The Code42 app before 6.8.4, as used in Code42 for Enterprise, on Linux installs with overly permissive permissions on the /usr/local/crashplan/log directory. This allows a user to manipulate symbolic links to escalate privileges, or show the contents of sensitive files that a regular user would not have access to.

Affected products

Code42/Crashplaninferred
Range: <6.8.4
Code42/Code422 versions
cpe:2.3:a:code42:code42:*:*:*:*:enterprise:*:*:*+ 1 more
- cpe:2.3:a:code42:code42:*:*:*:*:enterprise:*:*:*range: <6.8.4
- (no CPE)range: <6.8.4
Code42/Code42 For Enterprisellm-fuzzy
Range: <6.8.4

Patches

Vulnerability mechanics

References

www.securityfocus.com/bid/106452nvdThird Party AdvisoryVDB Entry
code42.com/r/support/CVE-2018-20131nvd

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000