PT-2019-14234 · Gog · Gog Galaxy

Adrian Denkiewicz · Published 2019-11-21 · Updated 2021-07-21 · CVE-2019-15511

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GOG Galaxy versions prior to 1.2.60 GOG Galaxy 2.0 Beta versions prior to the version that includes the fix for this issue

Description A local privilege escalation issue exists due to improper access control in the GalaxyClientService installed by GOG Galaxy, allowing an attacker to send unauthenticated local TCP packets and gain SYSTEM privileges on a Windows system with GOG Galaxy installed.

Recommendations For GOG Galaxy versions prior to 1.2.60, update to version 1.2.60 or later. For GOG Galaxy 2.0 Beta, wait for an updated version that includes the fix for this issue and apply it as soon as it becomes available. As a temporary workaround, consider restricting access to the GalaxyClientService to minimize the risk of exploitation.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-15511

Affected Products

Gog Galaxy

References · 5

• 🔥 https://github.com/adenkiewicz/CVE-2019-15511 · Exploit
• https://osv.dev/vulnerability/CVE-2019-15511 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15511 · Security Note
• https://support.gog.com/hc/en-us/articles/360025458833-GOG-GALAXY-2-0-updates-and-known-issues · Vendor Advisory
• https://cqureacademy.com/cqure-labs/cqlabs-cve-2019-15511-broken-access-control-in-gog-galaxy · Vendor Advisory