CVE-2019-11354
- State
- Published
- Severity
- Not scored
- Published
- Apr 19, 2019
- Updated
- Aug 4, 2024
- Reserved
- Apr 19, 2019
Description
The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices communication.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://blog.underdogsecurity.com/rce_in_origin_client/
- https://techcrunch.com/2019/04/16/ea-origin-bug-exposed-hackers/
- http://gamasutra.com/view/news/340907/A_nowfixed_Origin_vulnerability_potentially_opened_the_client_to_hackers.php
- https://www.thesun.co.uk/tech/8877334/sims-4-battlefield-fifa-origin-hackers/
- https://gizmodo.com/ea-origin-users-update-your-client-now-1834079604
- https://www.pcmag.com/news/367801/security-flaw-allowed-any-app-to-run-using-eas-origin-clien
- https://www.techradar.com/news/major-security-flaw-found-in-ea-origin-gaming-client
- https://www.trustedreviews.com/news/time-update-origin-eas-game-client-security-risk-just-installed-3697942
- https://www.vg247.com/2019/04/17/ea-origin-security-flaw-run-malicious-code-fixed/
- https://www.golem.de/news/sicherheitsluecke-ea-origin-fuehrte-schadcode-per-link-aus-1904-140738.html
- http://packetstormsecurity.com/files/153375/dotProject-2.1.9-SQL-Injection.html
- http://packetstormsecurity.com/files/153485/EA-Origin-Template-Injection-Remote-Code-Execution.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.