CVE-2018-17707CWE-78

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Epic Games Launcher versions prior to 8.2.2

published January 24, 2019

CVSS
—
EPSS
3%
Percentile
87.3
In the wild
Unconfirmed
What it is

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Epic Games Launcher versions prior to 8.2.2. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handler for the com.epicgames.launcher protocol. A crafted URI with the com.epicgames.launcher protocol can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-7241.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03004 · 87.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2019-01-24T04:00Z
EPSS history
Timeline
  • 24 JAN 04:00Z
    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Epic Games Launcher versions prior to 8.2.2
    cvelistv5