What’s Vulnerable › Vulnerabilities

CVE-2002-0770

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2002-08-12 · updated 2026-06-16

Description

Quake 2 (Q2) server 3.20 and 3.21 allows remote attackers to obtain sensitive server cvar variables, obtain directory listings, and execute Q2 server admin commands via a client that does not expand "$" macros, which causes the server to expand the macros and leak the information, as demonstrated using "say $rcon_password."

Affected products

• Id Software Quake 2I Server: 3.20, 3.21

References

• http://online.securityfocus.com/archive/1/272548
• http://www.iss.net/security_center/static/9095.php
• http://www.kb.cert.org/vuls/id/970915
• http://www.osvdb.org/11187
• http://www.quakesrc.org/forum/topicDisplay.php?topicID=160
• http://www.securityfocus.com/bid/4744
• http://online.securityfocus.com/archive/1/272548
• http://www.iss.net/security_center/static/9095.php
• http://www.kb.cert.org/vuls/id/970915
• http://www.osvdb.org/11187
• http://www.quakesrc.org/forum/topicDisplay.php?topicID=160
• http://www.securityfocus.com/bid/4744

Get alerted when CVE-2002-0770 or the next vulnerability affects your stack