Insync Client
Vendor:
First CVE: Feb 25, 2020 · Active for 6 years
6
Total CVEs
More Total CVEs than 80% of tracked products
3.0
Avg CVEs / Year
Higher CVE frequency than 76% of tracked products
7.8
Avg CVSS
Higher Avg CVSS than 63% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Insync Client over time
Volume of CVEsAvg CVSS Base Score
First CVE
Feb 25, 2020
6 years ago
Most Recent CVE
Jul 12, 2022
1,474 days ago
CVE Severity & Scoring
Insync Client6 CVEs
100%
All CVEs352,708 CVEs
45%
40%
11%
High
Attack Vector
Local6 (100.0%)
Network0 (0.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low6 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None6 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low6 (100.0%)
High0 (0.0%)
None0 (0.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-3999HIGH Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attacker to execute arbitrary operating syste | Feb 25, 2020 | 7.8 | 47 | NO | YES |
CVE-2020-5752HIGH Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges. | May 21, 2020 | 7.8 | 41 | NO | YES |
CVE-2021-36667HIGH Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server due to un-sanitized cal | Jul 12, 2022 | 7.8 | 28 | NO | NO |
CVE-2021-36668HIGH URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port parameter to the Electron App. | Jul 12, 2022 | 7.8 | 27 | NO | NO |
CVE-2021-36666HIGH An issue was discovered in Druva 6.9.0 for MacOS, allows attackers to gain escalated local privileges via the inSyncDecommission. | Jul 12, 2022 | 7.8 | 27 | NO | NO |
CVE-2021-36665HIGH An issue was discovered in Druva 6.9.0 for macOS, allows attackers to gain escalated local privileges via the inSyncUpgradeDaemon. | Jul 12, 2022 | 7.8 | 27 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (6 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
2 CVEs
33.3% of CVEs· 98th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
2 CVEs
33.3% of CVEs· 90th percentile
Social Chatter
Signals from CVEs in this product scope (6 CVEs).
Media Mentions
Signals from CVEs in this product scope (6 CVEs).
Top CNAs Publishing CVEs For Insync Client
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 6.6.3 | 1 | 7.8 | 8.6% | 0 | 1 |
| 6.5.0 | 1 | 7.8 | 8.6% | 0 | 1 |