CVE-2010-2627

Multiple directory traversal vulnerabilities in the Refractor 2 engine, as used in Battlefield 2 1.50 (1.5.3153-802.0) and earlier, and Battlefield 2142 (1.10.48.0) and earlier, allow remote servers to overwrite arbitrary files on the client via "..\" (dot dot backslash) sequences in URLs for the (1) sponsor or (2) community logos, and other URLs related to (3) DemoDownloadURL, (4) DemoIndexURL and (5) CustomMapsURL.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://aluigi.altervista.org/adv/bf2urlz-adv.txt
http://osvdb.org/65863	Exploit
http://secunia.com/advisories/40334	Vendor Advisory
http://www.securityfocus.com/bid/41262

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ea:battlefield_2::::::::
	cpe:2.3:a:ea:battlefield_2142::::::::

History

No history.

Information

Published : 2010-07-02 20:30

Updated : 2023-12-10 11:03

NVD link : CVE-2010-2627

Mitre link : CVE-2010-2627

CVE.ORG link : CVE-2010-2627

JSON object : View

Products Affected

ea

battlefield_2142
battlefield_2

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2010-2627", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2010-07-02T20:30:01.910", "references": [{"url": "http://aluigi.altervista.org/adv/bf2urlz-adv.txt", "source": "cve@mitre.org"}, {"url": "http://osvdb.org/65863", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/40334", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/41262", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Multiple directory traversal vulnerabilities in the Refractor 2 engine, as used in Battlefield 2 1.50 (1.5.3153-802.0) and earlier, and Battlefield 2142 (1.10.48.0) and earlier, allow remote servers to overwrite arbitrary files on the client via \"..\\\" (dot dot backslash) sequences in URLs for the (1) sponsor or (2) community logos, and other URLs related to (3) DemoDownloadURL, (4) DemoIndexURL and (5) CustomMapsURL."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de salto de directorio en el motor de Refractor 2, tal como se utiliza en Battlefield 2 v1.50 (v1.5.3153-802.0) y anteriores, y Battlefield 2142 (v1.10.48.0) y anteriores, permiten a servidores remotos sobrescribir archivos arbitrarios en el cliente a trav\u00e9s de secuencias \"..\\\"(punto-punto-barra invertida) en las direcciones URL de (1) el patrocinador (2) logotipos de la comunidad y otras URL relacionadas con (3) DemoDownloadURL, (4) DemoIndexURL y (5) CustomMapsURL."}], "lastModified": "2010-07-06T04:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ea:battlefield_2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC0C0EB8-F09A-40F1-A28C-4F0A0C2280B2", "versionEndIncluding": "2.1.50"}, {"criteria": "cpe:2.3:a:ea:battlefield_2142:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2EDD754-9895-4D94-B657-64AFA165CD6A", "versionEndIncluding": "1.10.48.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}