CVE-2020-5798
inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain...
CVE-2020-5798 is a high vulnerability (CVSS 7.8) in Druva Insync, published December 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 22nd percentile. No source names a fixed version.
- Severity
- 7.8 HighCVSS 3.1, NVD
- Exploit chance
- 0.29%EPSS, 22nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user from a lower privileged user due to improper integrity checks and directory permissions.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
What each source reports
NVD Score used
inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user from a lower privileged user due to improper integrity checks and directory permissions.
- Record
CVE-2020-5798- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-276, CWE-354
- Updated
- 2026-11-02
CVE ListNo score
inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user from a lower privileged user due to improper integrity checks and directory permissions.
- Record
CVE-2020-5798- Updated
- 2026-11-02
EUVDEUVD-2020-26955No score
inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user from a lower privileged user due to improper integrity checks and directory permissions.
- Record
EUVD-2020-26955- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wjv7-jqjx-m675No score
inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain...
inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user from a lower privileged user due to improper integrity checks and directory permissions.
- Record
GHSA-wjv7-jqjx-m675- Weakness
- CWE-276
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
tenable.com/security/research/tra-2020-67
nvd.nist.gov/vuln/detail/CVE-2020-5798
github.com/advisories/GHSA-wjv7-jqjx-m675