PT-2003-2375 · Epic Games · Unreal Tournament Server

Publicado 2003-12-31 · Atualizado 2017-07-29 · CVE-2003-1430

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Unreal Tournament Server versions 436 and earlier

Description The issue allows remote attackers to access known files via a ".." (dot dot) in an unreal:// URL, which is a type of directory traversal vulnerability. This means an attacker could potentially access sensitive files by manipulating the URL path.

Recommendations For versions 436 and earlier, consider restricting access to the unreal:// URL endpoint until a fix is available. As a temporary workaround, avoid using the ".." (dot dot) notation in URLs to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2003-1430

Produtos afetados

Unreal Tournament Server

Referências · 6

• 🔥 https://exploit-db.com/exploits/22224 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1430 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2003-02/0142.html · Nota
• http://securityfocus.com/bid/6775 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2003-02/0063.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11299 · Nota