CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2020-27708
https://notcve.org/view.php?id=CVE-2020-27708
A vulnerability exists in the Origin Client that could allow a non-Administrative user to elevate their access to either Administrator or System. Once the user has obtained elevated access, they may be able to take control of the system and perform actions otherwise reserved for high privileged users or system Administrators. Se presenta una vulnerabilidad en Origin Client que podría permitir a un usuario no administrativo elevar su acceso a Administrator o System. Una vez que el usuario ha obtenido un acceso elevado, ellos pueden ser capaces de tomar el control del sistema y llevar a cabo acciones que de otra manera estarían reservadas para usuarios con privilegios elevados o administradores del sistema • https://www.ea.com/security/news/easec-2020-002-elevation-of-privilege-vulnerability-in-origin-client • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19741
https://notcve.org/view.php?id=CVE-2019-19741
Electronic Arts Origin 10.5.55.33574 is vulnerable to local privilege escalation due to arbitrary directory DACL manipulation, a different issue than CVE-2019-19247 and CVE-2019-19248. When Origin.exe connects to the named pipe OriginClientService, the privileged service verifies the client's executable file instead of its in-memory process (which can be significantly different from the executable file due to, for example, DLL injection). Data transmitted over the pipe is encrypted using a static key. Instead of hooking the pipe communication directly via WriteFileEx(), this can be bypassed by hooking the EVP_EncryptUpdate() function of libeay32.dll. The pipe takes the command CreateDirectory to create a directory and adjust the directory DACL. • https://medium.com/%40tobiasgyoerfi/ea-origin-10-5-55-33574-createdirectory-arbitrary-dacl-write-privilege-escalation-cve-2019-19741-5f18adfabb27 •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19248
https://notcve.org/view.php?id=CVE-2019-19248
Electronic Arts Origin through 10.5.x allows Elevation of Privilege (issue 2 of 2). Electronic Arts Origin versiones hasta 10.5.x, permite una Elevación de Privilegios (problema 2 de 2). • https://www.ea.com/security/news/easec-2019-001-elevation-of-privilege-vulnerability-in-origin-client •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19247
https://notcve.org/view.php?id=CVE-2019-19247
Electronic Arts Origin through 10.5.x allows Elevation of Privilege (issue 1 of 2). Electronic Arts Origin versiones hasta 10.5.x, permite una Elevación de Privilegios problema 1 de 2). • https://www.ea.com/security/news/easec-2019-001-elevation-of-privilege-vulnerability-in-origin-client •
CVSS: 8.8EPSS: 23%CPEs: 1EXPL: 4CVE-2019-12828 – Electronic Arts Origin URI Handler Remote Command Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-12828
An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and origin2:// URI schemes, it is possible to inject additional arguments into the Origin process and ultimately leverage code execution by loading a backdoored Qt plugin remotely via the platformpluginpath argument supplied with a Windows network share. Fue encontrado un problema en Origin de Electronic Arts anterior a versión 10.5.39. Debido a un saneamiento inapropiado de los esquemas URI origin:// y origin2://, es posible inyectar argumentos adicionales en el proceso Origin y, finalmente, impulsar la ejecución del código cargando un plugin Qt de puerta trasera (backdoor) remotamente por medio del argumento platformpluginpath suministrado con una red compartida de Windows. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Electronic Arts Origin. • https://www.exploit-db.com/exploits/47019 http://packetstormsecurity.com/files/153385/EA-Origin-Remote-Code-Execution.html https://www.bleepingcomputer.com/news/security/qt5-based-gui-apps-susceptible-to-remote-code-execution https://www.youtube.com/watch?v=E9vCx9KsF3c https://www.zerodayinitiative.com/advisories/ZDI-19-574 https://zeropwn.github.io/2019-05-22-fun-with-uri-handlers • CWE-19: Data Processing Errors •