PT-2020-14709 · Electronic Arts · Origin Client

Ahmed El-Monairy · Published 2020-10-30 · Updated 2020-11-12 · CVE-2020-15914

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Origin Client for Mac and PC versions 10.5.86 or earlier

Description A cross-site scripting (XSS) issue exists that could allow a remote attacker to execute arbitrary Javascript in a target user’s Origin client. This could enable access to sensitive data related to the target user’s Origin account, or control and monitoring of the Origin text chat window.

Recommendations For versions 10.5.86 or earlier, update to a version later than 10.5.86 to resolve the issue. As a temporary workaround, consider restricting the use of the Origin text chat window until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-15914

Affected Products

Origin Client

References · 4

• 🔥 https://github.com/Monairy/Security-Advisories/blob/master/CVE%202020-15914 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-15914 · Security Note
• https://ea.com/security/news/easec-2020-003-cross-site-scripting-vulnerability-in-origin-client · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15914 · Vendor Advisory