CVE-2019-15316

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition.

Metrics

CVSS 3.0 7.0/10CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-367 CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Aug 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-153175.4The give plugin before 2.4.7 for WordPress has XSS via a donor name.CVE-2019-153189.8The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.CVE-2019-153199.8The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.CVE-2019-153209.8The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.CVE-2019-153219.8The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.CVE-2019-153229.8The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.CVE-2019-153237.5The ad-inserter plugin before 2.4.20 for WordPress has path traversal.CVE-2019-153248.8The ad-inserter plugin before 2.4.22 for WordPress has remote code execution.CVE-2019-153257.5In GalliumOS 3.0, CONFIG_SECURITY_YAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/ptrace_scope to 1, wh CVE-2019-153267.5The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.CVE-2019-153276.1The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.CVE-2019-153286.1The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.