CVE-2019-11354

The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler

published April 19, 2019

CVSS
—
EPSS
23%
Percentile
97.8
In the wild
Unconfirmed
What it is

The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices communication.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.23129 · 97.8th percentile
Published
2019-04-19T21:29Z
EPSS history
Timeline
  • 19 APR 21:29Z
    The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler
    cvelistv5