CVE-2020-15349 – BinaryNights ForkLift 3.x before 3.4 has a local privilege escalation vul

BinaryNights ForkLift 3.x before 3.4 has a local privilege escalation vulnerability because the privileged helper tool implements an XPC interface that allows file operations to any process (copy, move, delete) as root and changing permissions.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15349

Reference (s):

• https://binarynights.com/blog/posts/forklift-3-4-security-update.html
• https://insinuator.net/2020/11/forklift-lpe/