High severity7.8NVD Advisory· Published Dec 27, 2020· Updated Jun 17, 2026

CVE-2020-8289

Description

Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in bztransmit helper due to hardcoded whitelist of strings in URLs where validation is disabled leading to possible remote code execution via client update functionality.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Backblaze/Backblaze3 versions
cpe:2.3:a:backblaze:backblaze:*:*:*:*:*:macos:*:*+ 2 more
- cpe:2.3:a:backblaze:backblaze:*:*:*:*:*:macos:*:*range: <7.0.1.434
- cpe:2.3:a:backblaze:backblaze:*:*:*:*:*:windows:*:*range: <7.0.1.433
- (no CPE)range: <7.0.1.433
Backblaze/Backblaze for Windowsdescription

Patches

Vulnerability mechanics

References

github.com/geffner/CVE-2020-8289/blob/master/README.mdnvdExploitThird Party Advisory
youtu.be/W0THXbcX5V8nvdExploitThird Party Advisory
seclists.org/fulldisclosure/2020/Dec/57nvdMailing ListThird Party Advisory
seclists.org/fulldisclosure/2020/Dec/58nvdMailing ListThird Party Advisory
www.backblaze.com/blog/backblaze-cloud-backup-release-7-0-1/nvdThird Party Advisory
hackerone.com/reports/818853nvdPermissions Required

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000