CVE-2010-2627

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-07-02 · updated 2026-06-16
Weakness: CWE-22

Description

Multiple directory traversal vulnerabilities in the Refractor 2 engine, as used in Battlefield 2 1.50 (1.5.3153-802.0) and earlier, and Battlefield 2142 (1.10.48.0) and earlier, allow remote servers to overwrite arbitrary files on the client via "..\" (dot dot backslash) sequences in URLs for the (1) sponsor or (2) community logos, and other URLs related to (3) DemoDownloadURL, (4) DemoIndexURL and (5) CustomMapsURL.

Affected products

Ea Battlefield 2: through 2.1.50
Ea Battlefield 2142: through 1.10.48.0

References

http://aluigi.altervista.org/adv/bf2urlz-adv.txt
http://osvdb.org/65863
http://secunia.com/advisories/40334
http://www.securityfocus.com/bid/41262
http://aluigi.altervista.org/adv/bf2urlz-adv.txt
http://osvdb.org/65863
http://secunia.com/advisories/40334
http://www.securityfocus.com/bid/41262

Get alerted when CVE-2010-2627 or the next vulnerability affects your stack