« Volver al listado

CVE-2010-2627

Estado: ModificadaMedia (6.8)—

Multiple directory traversal vulnerabilities in the Refractor 2 engine, as used in Battlefield 2 1.50 (1.5.3153-802.0) and earlier, and Battlefield 2142 (1.10.48.0) and earlier, allow remote servers to overwrite arbitrary files on the client via "..\" (dot dot backslash) sequences in URLs for the (1) sponsor or (2) community logos, and other URLs related to (3) DemoDownloadURL, (4) DemoIndexURL and (5) CustomMapsURL.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

EA — Battlefield 2EA — Battlefield 2142

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-2627",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-07-02T20:30:01.910",
  "references": [
    {
      "url": "http://aluigi.altervista.org/adv/bf2urlz-adv.txt",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/65863",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/40334",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/41262",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://aluigi.altervista.org/adv/bf2urlz-adv.txt",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/65863",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/40334",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/41262",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple directory traversal vulnerabilities in the Refractor 2 engine, as used in Battlefield 2 1.50 (1.5.3153-802.0) and earlier, and Battlefield 2142 (1.10.48.0) and earlier, allow remote servers to overwrite arbitrary files on the client via \"..\\\" (dot dot backslash) sequences in URLs for the (1) sponsor or (2) community logos, and other URLs related to (3) DemoDownloadURL, (4) DemoIndexURL and (5) CustomMapsURL."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de salto de directorio en el motor de Refractor 2, tal como se utiliza en Battlefield 2 v1.50 (v1.5.3153-802.0) y anteriores, y Battlefield 2142 (v1.10.48.0) y anteriores, permiten a servidores remotos sobrescribir archivos arbitrarios en el cliente a través de secuencias \"..\\\"(punto-punto-barra invertida) en las direcciones URL de (1) el patrocinador (2) logotipos de la comunidad y otras URL relacionadas con (3) DemoDownloadURL, (4) DemoIndexURL y (5) CustomMapsURL."
    }
  ],
  "lastModified": "2026-06-16T23:21:06.427",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ea:battlefield_2:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC0C0EB8-F09A-40F1-A28C-4F0A0C2280B2",
              "versionEndIncluding": "2.1.50"
            },
            {
              "criteria": "cpe:2.3:a:ea:battlefield_2142:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B2EDD754-9895-4D94-B657-64AFA165CD6A",
              "versionEndIncluding": "1.10.48.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}