CVE-2021-33879 - CVE House
Back to Database
Status published High CVE-2021-33879

Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP...

Vulnerability Description

Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an XML document describing an update package, replacing a download URL with one pointing to an arbitrary Windows executable. Because the only integrity check would be a comparison of the downloaded file's MD5 checksum to the one contained within the XML document, the downloaded executable would then be executed on the victim's machine.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-33879

Credits & Attribution

No credits recorded in the NVD database.

References

More from tencent

View All →
CVE-2022-35158
A vulnerability in the lua parser of TscanCode tsclua v2.15.01...
High 7.5
CVE-2021-40180
In the WeChat application 8.0.10 for Android and iOS, a...
High 7.5
CVE-2021-33057
The QQ application 8.7.1 for Android and iOS does not...
High 7.5
CVE-2020-24162
The Shenzhen Tencent app 5.8.2.5300 for PC platforms (from Tencent...
High 7.8
CVE-2020-24160
Shenzhen Tencent TIM Windows client 3.0.0.21315 has a DLL hijacking...
High 7.8

Affected Vendor

Affected Software

gameloop
Vulnerable Versions:
0

Timeline

Official Publish: June 6th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.