PT-2019-14234 · Gog · Gog Galaxy

Adrian Denkiewicz · Publicado 2019-11-21 · Atualizado 2021-07-21 · CVE-2019-15511

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GOG Galaxy versions prior to 1.2.60 GOG Galaxy 2.0 Beta versions prior to the version that includes the fix for this issue

Description A local privilege escalation issue exists due to improper access control in the GalaxyClientService installed by GOG Galaxy, allowing an attacker to send unauthenticated local TCP packets and gain SYSTEM privileges on a Windows system with GOG Galaxy installed.

Recommendations For GOG Galaxy versions prior to 1.2.60, update to version 1.2.60 or later. For GOG Galaxy 2.0 Beta, wait for an updated version that includes the fix for this issue and apply it as soon as it becomes available. As a temporary workaround, consider restricting access to the GalaxyClientService to minimize the risk of exploitation.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2019-15511

Produtos afetados

Gog Galaxy

Referências · 5

• 🔥 https://github.com/adenkiewicz/CVE-2019-15511 · Exploit
• https://osv.dev/vulnerability/CVE-2019-15511 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15511 · Nota de Segurança
• https://support.gog.com/hc/en-us/articles/360025458833-GOG-GALAXY-2-0-updates-and-known-issues · Aviso do Fabricante
• https://cqureacademy.com/cqure-labs/cqlabs-cve-2019-15511-broken-access-control-in-gog-galaxy · Aviso do Fabricante