VulnerabilityModified
CVE-2004-2594
Absolute path traversal vulnerability in Quake II server before R1Q2 on Windows, as used in multiple products, allows remote attackers to read arbitrary files via a "\/" in a pathname argument, as demonstrated by "download \/server.cfg".
MEDIUM 5.0EPSS 1.80%
Does this matter?
Lower severity and a low EPSS score (1.80%). Track it; it rarely justifies an emergency change on its own.
Description
Absolute path traversal vulnerability in Quake II server before R1Q2 on Windows, as used in multiple products, allows remote attackers to read arbitrary files via a "\/" in a pathname argument, as demonstrated by "download \/server.cfg".
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 1.80% probability · 77th percentile
- CISA KEV
- Not listed
- Affected
- id software/quake ii server windows
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/bugtraq/2004-10/0299.htmlExploit
- http://secunia.com/advisories/13013Vendor Advisory
- http://secur1ty.net/advisories/001Exploit, Vendor Advisory
- http://securitytracker.com/id?1011979Exploit
- http://web.archive.org/web/20041130092749/www.r1ch.net/stuff/r1q2/
- http://www.osvdb.org/11183
- http://www.securityfocus.com/bid/11551
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17892
- http://archives.neohapsis.com/archives/bugtraq/2004-10/0299.htmlExploit
- http://secunia.com/advisories/13013Vendor Advisory
- http://secur1ty.net/advisories/001Exploit, Vendor Advisory
- http://securitytracker.com/id?1011979Exploit
- http://web.archive.org/web/20041130092749/www.r1ch.net/stuff/r1q2/
- http://www.osvdb.org/11183
- http://www.securityfocus.com/bid/11551
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17892
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.