CVE-2021-33879

Katalog CVE

CVSS 8.1 · High EPSS 1,2%

Kerentanan Download of Code Without Integrity Check pada tencent gameloop. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an XML document describing an update package, replacing a download URL with one pointing to an arbitrary Windows executable. Because the only integrity check would be a comparison of the downloaded file's MD5 checksum to the one contained within the XML document, the downloaded executable would then be executed on the victim's machine.

Rincian

Terbit di NVD

6 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-494: Download of Code Without Integrity Check

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.gameloop.com advisory vendor
• https://github.com/mmiszczyk/cve-2021-33879 exploit · advisory pihak ketiga