CVE-2010-2627
Multiple directory traversal vulnerabilities in the Refractor 2 engine, as used in Battlefield 2 1.50 (1.5.3153-802.0) and earlier, and Battlefield 2142 (1.10.48.0) and earlier, allow remote servers to overwrite arbitrary files on the client via "..\"…
Does this matter?
Lower severity and a low EPSS score (3.66%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple directory traversal vulnerabilities in the Refractor 2 engine, as used in Battlefield 2 1.50 (1.5.3153-802.0) and earlier, and Battlefield 2142 (1.10.48.0) and earlier, allow remote servers to overwrite arbitrary files on the client via "..\" (dot dot backslash) sequences in URLs for the (1) sponsor or (2) community logos, and other URLs related to (3) DemoDownloadURL, (4) DemoIndexURL and (5) CustomMapsURL.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 3.66% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- ea/battlefield 2 · ea/battlefield 2142
- Source
- cve@mitre.org
References
- http://aluigi.altervista.org/adv/bf2urlz-adv.txt
- http://osvdb.org/65863Exploit
- http://secunia.com/advisories/40334Vendor Advisory
- http://www.securityfocus.com/bid/41262
- http://aluigi.altervista.org/adv/bf2urlz-adv.txt
- http://osvdb.org/65863Exploit
- http://secunia.com/advisories/40334Vendor Advisory
- http://www.securityfocus.com/bid/41262
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.