PT-2019-14986 · Valve · Steam Client

B0Yd + 1 · Published 2019-10-04 · Updated 2020-01-16 · CVE-2019-17180

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Valve Steam Client versions prior to 2019-09-12

Description The issue allows for the placement or appending of partially controlled filesystem content. This could be demonstrated through file modifications on Windows, specifically in the context of NT AUTHORITYSYSTEM, potentially leading to denial of service, elevation of privilege, or other unspecified impacts.

Recommendations For versions prior to 2019-09-12, update to a version released after 2019-09-12 to resolve the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-17180

PYSEC-2019-125

Affected Products

Steam Client

References · 8

• 🔥 https://amonitoring.ru/article/steam_vuln_3 · Exploit
• 🔥 https://habr.com/ru/company/pm/blog/469507 · Exploit
• 🔥 https://hackerone.com/reports/682774 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-17180 · Security Note
• https://store.steampowered.com/news/54236 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-17180 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-125 · Vendor Advisory
• https://hackerone.com/reports/583184 · Note