CVE-2018-3974

An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy's install directory. An attacker can overwrite an executable that is launched as a system service on boot by default to exploit this vulnerability and execute arbitrary code with system privileges.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0640	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gog:galaxy:1.2.45.61:*:*:*:*:*:*:*

History

02 Feb 2023, 13:36

Type	Values Removed	Values Added
References	~~(MISC) https://talosintelligence.com/vulnerability_reports/TALOS-2018-0640 - Third Party Advisory~~	(MISC) https://talosintelligence.com/vulnerability_reports/TALOS-2018-0640 - Exploit, Third Party Advisory

Information

Published : 2019-04-02 16:29

Updated : 2023-12-10 12:59

NVD link : CVE-2018-3974

Mitre link : CVE-2018-3974

CVE.ORG link : CVE-2018-3974

JSON object : View

Products Affected

gog

galaxy

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2018-3974", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 9.3, "attackVector": "LOCAL", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.5}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2019-04-02T16:29:00.327", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2018-0640", "tags": ["Exploit", "Third Party Advisory"], "source": "talos-cna@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy's install directory. An attacker can overwrite an executable that is launched as a system service on boot by default to exploit this vulnerability and execute arbitrary code with system privileges."}, {"lang": "es", "value": "Existe una vulnerabilidad explotable de escalado de privilegios local en los permisos de sistema de archivos del directorio de instalaci\u00f3n de GOG Galaxy. Un atacante puede sobrescribir ejecutables que se lanzan al arrancar, como servicio de sistema por defecto, para explotar esta vulnerabilidad y ejecutar c\u00f3digo arbitrario con privilegios de sistema."}], "lastModified": "2023-02-02T13:36:29.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gog:galaxy:1.2.45.61:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE5448CD-A5C1-4A96-8717-CC7834B84177"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}