PT-2019-14986 · Valve · Steam Client

B0Yd + 1 · Publicado 2019-10-04 · Atualizado 2020-01-16 · CVE-2019-17180

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Valve Steam Client versions prior to 2019-09-12

Description The issue allows for the placement or appending of partially controlled filesystem content. This could be demonstrated through file modifications on Windows, specifically in the context of NT AUTHORITYSYSTEM, potentially leading to denial of service, elevation of privilege, or other unspecified impacts.

Recommendations For versions prior to 2019-09-12, update to a version released after 2019-09-12 to resolve the issue.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-17180

PYSEC-2019-125

Produtos afetados

Steam Client

Referências · 8

• 🔥 https://amonitoring.ru/article/steam_vuln_3 · Exploit
• 🔥 https://habr.com/ru/company/pm/blog/469507 · Exploit
• 🔥 https://hackerone.com/reports/682774 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-17180 · Nota de Segurança
• https://store.steampowered.com/news/54236 · Aviso do Fabricante
• https://hackerone.com/reports/583184 · Nota
• https://osv.dev/vulnerability/CVE-2019-17180 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2019-125 · Aviso do Fabricante