What is CVE-2020-27384?

CVE-2020-27384 is a high-severity vulnerability in Arena Guild Wars 2, classified under Incorrect Default Permissions. CVSS score: 7.8/10. Published 2021-06-09.

How severe is CVE-2020-27384?

High severity. CVSS v3 base score is 7.8 out of 10.

Is CVE-2020-27384 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Arena Guild Wars 2

CVE-2020-27384

The Gw2-64.exe in Guild Wars 2 launcher version 106916 suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to modify the existing executable file with a binary of his choice. The vulnerability exist due to the improper permissions, with the 'F' flag (Full Control) for 'Everyone' group, making the entire directory 'Guild Wars 2' and its files and sub-dirs world-writable.

EPSS: 0.003 (24.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Arena Guild_wars_2 — versions 106916
N/a — versions n/a

Weakness classification (CWE)

CWE-276 — Incorrect Default Permissions

Public proof-of-concept exploits

n0-traces/cve_

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-27384?: CVE-2020-27384 is a high-severity vulnerability in Arena Guild Wars 2, classified under Incorrect Default Permissions. CVSS score: 7.8/10. Published 2021-06-09.
How severe is CVE-2020-27384?: High severity. CVSS v3 base score is 7.8 out of 10.
Is CVE-2020-27384 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.