CVEvulnerability
CVE-2019-17180
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-10-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-22
Description
Valve Steam Client before 2019-09-12 allows placing or appending partially controlled filesystem content, as demonstrated by file modifications on Windows in the context of NT AUTHORITY\SYSTEM. This could lead to denial of service, elevation of privilege, or unspecified other impact.
Affected configurations
• valvesoftware steam client (< 2019-09-12)
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://amonitoring.ru/article/steam_vuln_3/ Exploit, Third Party Advisory
- https://habr.com/ru/company/pm/blog/469507/ Exploit, Third Party Advisory
- https://hackerone.com/reports/583184 hackerone.com
- https://hackerone.com/reports/682774 Exploit, Third Party Advisory
- https://store.steampowered.com/news/54236/ Release Notes, Vendor Advisory
- https://amonitoring.ru/article/steam_vuln_3/ Exploit, Third Party Advisory
- https://habr.com/ru/company/pm/blog/469507/ Exploit, Third Party Advisory
- https://hackerone.com/reports/583184 hackerone.com
- https://hackerone.com/reports/682774 Exploit, Third Party Advisory
- https://store.steampowered.com/news/54236/ Release Notes, Vendor Advisory