CVE-2018-20131

CVE-2018-20131 describes a local privilege escalation vulnerability affecting the Code42 app before version 6.8.4 on Linux systems, specifically within Code42 for Enterprise deployments. The flaw stems from overly permissive permissions on the /usr/local/crashplan/log directory, allowing a local authenticated user to manipulate symbolic links. This can lead to privilege escalation or unauthorized disclosure of sensitive file contents. Rated with a CVSS score of 7.8 (High), the vulnerability has a low attack complexity and requires local user access, but can result in high impact to confidentiality, integrity, and availability. Despite its high severity, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit or Nuclei, or entries in ExploitDB. Community discussion and media coverage for this CVE are also minimal, indicating low public awareness and attention.