PT-2003-2375 · Epic Games · Unreal Tournament Server

Published 2003-12-31 · Updated 2017-07-29 · CVE-2003-1430

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Unreal Tournament Server versions 436 and earlier

Description The issue allows remote attackers to access known files via a ".." (dot dot) in an unreal:// URL, which is a type of directory traversal vulnerability. This means an attacker could potentially access sensitive files by manipulating the URL path.

Recommendations For versions 436 and earlier, consider restricting access to the unreal:// URL endpoint until a fix is available. As a temporary workaround, avoid using the ".." (dot dot) notation in URLs to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2003-1430

Affected Products

Unreal Tournament Server

References · 6

• 🔥 https://exploit-db.com/exploits/22224 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1430 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2003-02/0142.html · Note
• http://securityfocus.com/bid/6775 · Note
• http://archives.neohapsis.com/archives/bugtraq/2003-02/0063.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11299 · Note