← voltar
CVE-2019-11354

CVE-2019-11354

28Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendepss 23%
da publicação à arma66 dias
Publicada no NVD19 de abr.
1ª PoC+66d
probabilidade de exploração
23%top 2% das CVEs
exploração observada
nãonenhuma fonte reporta
3 exploit(s) público(s)
The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices communication.
Produtos afetados
n/a · n/a
PoCs públicas encontradas — 3
cve_referencepacketstormsecurity.com/files/153375/dotProject-2.1.9-SQL-Injection.htmlnão verificadocve_referencepacketstormsecurity.com/files/153485/EA-Origin-Template-Injection-Remote-Code-Execution.htmlnão verificadoexploitdbwww.exploit-db.com/exploits/47021não verificado
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
http://gamasutra.com/view/news/340907/A_nowfixed_Origin_vulnerability_potentially_opened_the_client_to_hackers.phphttp://packetstormsecurity.com/files/153375/dotProject-2.1.9-SQL-Injection.htmlhttp://packetstormsecurity.com/files/153485/EA-Origin-Template-Injection-Remote-Code-Execution.htmlhttps://blog.underdogsecurity.com/rce_in_origin_client/https://gizmodo.com/ea-origin-users-update-your-client-now-1834079604https://techcrunch.com/2019/04/16/ea-origin-bug-exposed-hackers/https://www.golem.de/news/sicherheitsluecke-ea-origin-fuehrte-schadcode-per-link-aus-1904-140738.htmlhttps://www.pcmag.com/news/367801/security-flaw-allowed-any-app-to-run-using-eas-origin-clienhttps://www.techradar.com/news/major-security-flaw-found-in-ea-origin-gaming-clienthttps://www.thesun.co.uk/tech/8877334/sims-4-battlefield-fifa-origin-hackers/https://www.trustedreviews.com/news/time-update-origin-eas-game-client-security-risk-just-installed-3697942https://www.vg247.com/2019/04/17/ea-origin-security-flaw-run-malicious-code-fixed/