PT-2019-10779 · Gog · Gog Galaxy

Published 2019-04-02 · Updated 2022-06-07 · CVE-2018-4049

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GOG Galaxy version 1.2.48.36

Description A local privilege elevation issue exists in the file system permissions of the "Games" directory. This allows an attacker to overwrite executables of installed games, potentially leading to the execution of arbitrary code with elevated privileges.

Recommendations For version 1.2.48.36, consider restricting access to the "Games" directory to prevent unauthorized modifications until a patch is available. As a temporary workaround, monitor the directory for any suspicious changes to executables of installed games.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2018-4049

Affected Products

Gog Galaxy

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-4049 · Security Note
• https://osv.dev/vulnerability/CVE-2018-4049 · Vendor Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2018-0723 · Note