PT-2019-10779 · Gog · Gog Galaxy

Publicado 2019-04-02 · Atualizado 2022-06-07 · CVE-2018-4049

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Crítica

Vetor base

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GOG Galaxy version 1.2.48.36

Description A local privilege elevation issue exists in the file system permissions of the "Games" directory. This allows an attacker to overwrite executables of installed games, potentially leading to the execution of arbitrary code with elevated privileges.

Recommendations For version 1.2.48.36, consider restricting access to the "Games" directory to prevent unauthorized modifications until a patch is available. As a temporary workaround, monitor the directory for any suspicious changes to executables of installed games.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2018-4049

Produtos afetados

Gog Galaxy

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-4049 · Nota de Segurança
• https://talosintelligence.com/vulnerability_reports/TALOS-2018-0723 · Nota
• https://osv.dev/vulnerability/CVE-2018-4049 · Aviso do Fabricante