CVE-2021-47742 | BDVDB-2026-308668 Detail
Epic GamesEpic Games Psyonix Rocket League
Description#
Epic Games Psyonix Rocket League <=1.95 contains an insecure permissions vulnerability that allows authenticated users to modify executable files with full access permissions. Attackers can leverage the 'F' (Full) flag for the 'Authenticated Users' group to change executable files and potentially escalate system privileges.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-732 Incorrect Permission Assignment for Critical Resource
References#
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5650.php
- https://packetstormsecurity.com/files/162435
- https://exchange.xforce.ibmcloud.com/vulnerabilities/201128
- https://www.rocketleague.com/
- https://www.vulncheck.com/advisories/epic-games-psyonix-rocket-league-elevation-of-privileges-via-insecure-permissions
Exploit#
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.