High severity · published Sep 24, 2020
CVE-2020-15850
Insecure permissions in Nakivo Backup & Replication Director version 9.4.0.r43656 on Linux allow local users to access the Nakivo Director web interface and gain root privileges
7.8
CVSS
0.5%
EPSS
No
On KEV
Description
Insecure permissions in Nakivo Backup & Replication Director version 9.4.0.r43656 on Linux allow local users to access the Nakivo Director web interface and gain root privileges. This occurs because the database containing the users of the web application and the password-recovery secret value is readable.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BR
Backup & Replication Director · Nakivo
9.4.0.r43656 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15850
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15850
Release Notes
https://helpcenter.nakivo.com/display/RN/v10.3+Release+Notes
Exploit
https://labs.f-secure.com/advisories/nakivo-backup-and-replication-multiple-vulnerabilities
More from Backup & Replication Director
8.6
CVE-2024-48248
NAKIVO Backup and Replication Absolute Path Traversal Vulnerability
8.6
CVE-2025-32406
An XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1 before 11.0.2 allows remote attackers fetch and parse the XML response