CVE-2023-50914 Privilege escalation in n/a
Authenticated users can escalate privileges by modifying IPC parameters to grant Everyone full control over arbitrary system directories.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-50914?
CVE-2023-50914 is a medium-severity vulnerability in n/a, published on 30 Apr 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A Privilege Escalation issue in the inter-process communication procedure from GOG Galaxy (Beta) 2.0.67.2 through v2.0.71.2 allows authentictaed users to change the DACL of arbitrary system directories to include Everyone full control permissions by modifying the FixDirectoryPrivileges instruction parameters sent from GalaxyClient.exe to GalaxyClientService.exe.
Weakness: CWE-279
Which versions are affected by CVE-2023-50914?
How do I fix CVE-2023-50914?
No fix has been published for CVE-2023-50914 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-50914 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-50914 exists.
Sources
Also known as GHSA-8q89-vwgf-h32f.