CVE-2002-0770
Quake 2 (Q2) server 3.20 and 3.21 allows remote attackers to obtain sensitive server cvar...
CVE-2002-0770 is a medium vulnerability (CVSS 5.0) in Id Software Quake 2i Server, published July 26, 2002. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.53%, the 92nd percentile. No source names a fixed version.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 5.53%EPSS, 92nd percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
Quake 2 (Q2) server 3.20 and 3.21 allows remote attackers to obtain sensitive server cvar variables, obtain directory listings, and execute Q2 server admin commands via a client that does not expand "$" macros, which causes the server to expand the macros and leak the information, as demonstrated using "say $rcon_password."
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | id Software Quake II Server 3.20/3.21 - Remote Information Disclosure | 2002-05-15 |
What each source reports
NVD Score used
Quake 2 (Q2) server 3.20 and 3.21 allows remote attackers to obtain sensitive server cvar variables, obtain directory listings, and execute Q2 server admin commands via a client that does not expand "$" macros, which causes the server to expand the macros and leak the information, as demonstrated using "say $rcon_password."
- Record
CVE-2002-0770- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE ListNo score
Quake 2 (Q2) server 3.20 and 3.21 allows remote attackers to obtain sensitive server cvar variables, obtain directory listings, and execute Q2 server admin commands via a client that does not expand "$" macros, which causes the server to expand the macros and leak the information, as demonstrated using "say $rcon_password."
- Record
CVE-2002-0770- Updated
- 2026-11-02
EUVDEUVD-2002-0762No score
Quake 2 (Q2) server 3.20 and 3.21 allows remote attackers to obtain sensitive server cvar variables, obtain directory listings, and execute Q2 server admin commands via a client that does not expand "$" macros, which causes the server to expand the macros and leak the information, as demonstrated using "say $rcon_password."
- Record
EUVD-2002-0762- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-57gh-g4wc-3xq3No score
Quake 2 (Q2) server 3.20 and 3.21 allows remote attackers to obtain sensitive server cvar...
Quake 2 (Q2) server 3.20 and 3.21 allows remote attackers to obtain sensitive server cvar variables, obtain directory listings, and execute Q2 server admin commands via a client that does not expand "$" macros, which causes the server to expand the macros and leak the information, as demonstrated using "say $rcon_password."
- Record
GHSA-57gh-g4wc-3xq3- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.