CVE-2019-15511 - An exploitable local privilege escalation vulnerability exists in the GalaxyClientService installed by GOG Galaxy

Back Back to CVE browser

HIGH

An exploitable local privilege escalation vulnerability exists in the GalaxyClientService installed by GOG Galaxy

Published Nov 21, 2019

7.8

HIGH

CVSS 3.1

EPSS 0.75%

Description

An exploitable local privilege escalation vulnerability exists in the GalaxyClientService installed by GOG Galaxy. Due to Improper Access Control, an attacker can send unauthenticated local TCP packets to the service to gain SYSTEM privileges in Windows system where GOG Galaxy software is installed. All GOG Galaxy versions before 1.2.60 and all corresponding versions of GOG Galaxy 2.0 Beta are affected.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-306

Missing Authentication

References (2)

https://cqureacademy.com/cqure-labs/cqlabs-cve-2019-15511-broken-access-control-in-gog-galaxy
x_refsource_MISCThird Party AdvisoryVendor Advisory
https://support.gog.com/hc/en-us/articles/360025458833-GOG-GALAXY-2-0-updates-and-known-issues
x_refsource_MISCRelease NotesVendor Advisory

Link	Providers	Tags
https://cqureacademy.com/cqure-labs/cqlabs-cve-2019-15511-broken-access-control-in-gog-galaxy		x_refsource_MISCThird Party AdvisoryVendor Advisory
https://support.gog.com/hc/en-us/articles/360025458833-GOG-GALAXY-2-0-updates-and-known-issues		x_refsource_MISCRelease NotesVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Nov 21, 2019

Updated Aug 5, 2024

Reserved Aug 23, 2019

Link CVE-2019-15511

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-15511

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-15511