CVE-2004-2594 Absolute path traversal vulnerability in Quake II server before R1Q2 on Windows, as used in multiple products, allows remote attackers to read arbitrary files via a "/" in a pathname argument, as demo...
MediumCVSS 5.0
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Absolute path traversal vulnerability in Quake II server before R1Q2 on Windows, as used in multiple products, allows remote attackers to read arbitrary files via a "/" in a pathname argument, as demonstrated by "download /server.cfg".
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| id software quake ii server windows | = 3.20 | No fix listed |
| id software quake ii server windows | = 3.21 | No fix listed |
References
- 20041027 Multiple Vulnerabilites in Quake II Server exploit mailing-list
- 13013 third-party-advisory vendor-advisory
- secur1ty.net exploit vendor-advisory
- 1011979 exploit vdb-entry
- web.archive.org
- 11183 vdb-entry
- 11551 vdb-entry
- quake-path-information-disclosure(17892) vdb-entry