CVE-2002-0770
- State
- Published
- Severity
- Not scored
- Published
- Jul 26, 2002
- Updated
- Aug 8, 2024
- Reserved
- Jul 25, 2002
Description
Quake 2 (Q2) server 3.20 and 3.21 allows remote attackers to obtain sensitive server cvar variables, obtain directory listings, and execute Q2 server admin commands via a client that does not expand "$" macros, which causes the server to expand the macros and leak the information, as demonstrated using "say $rcon_password."
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- quake2-unexpanded-var-disclosure(9095)vdb-entry
- 20020514 Remote quake 2 3.2x server cvar leakmailing-list
- VU#970915third-party-advisory
- 11187vdb-entry
- http://www.quakesrc.org/forum/topicDisplay.php?topicID=160
- 4744vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.