{"api_version":"1","generated_at":"2026-07-23T13:33:34+00:00","cve":"CVE-2004-0273","urls":{"html":"https://cve.report/CVE-2004-0273","api":"https://cve.report/api/cve/CVE-2004-0273.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2004-0273","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2004-0273"},"summary":{"title":"CVE-2004-0273","description":"Directory traversal vulnerability in RealOne Player, RealOne Player 2.0, and RealOne Enterprise Desktop allows remote attackers to upload arbitrary files via an RMP file that contains .. (dot dot) sequences in a .rjs skin file.","state":"PUBLISHED","assigner":"mitre","published_at":"2004-11-23 05:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["CWE-22","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"9.3","severity":"","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://www.securityfocus.com/bid/9580","name":"http://www.securityfocus.com/bid/9580","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"RealPlayer/RealOne Player RMP Skin File Handler Directory Traversal Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://service.real.com/help/faq/security/040123_player/EN/","name":"http://service.real.com/help/faq/security/040123_player/EN/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Customer Support - Real Security Updates","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://marc.info/?l=bugtraq&m=107642978524321&w=2","name":"http://marc.info/?l=bugtraq&m=107642978524321&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15123","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15123","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.kb.cert.org/vuls/id/514734","name":"http://www.kb.cert.org/vuls/id/514734","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["US Government Resource"],"title":"US-CERT Vulnerability Note VU#514734","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2004-0273","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-0273","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2004","cve_id":"273","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"realnetworks","cpe5":"realone_desktop_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2004","cve_id":"273","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"realnetworks","cpe5":"realone_enterprise_desktop","cpe6":"6.0.11.774","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2004","cve_id":"273","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"realnetworks","cpe5":"realone_player","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2004","cve_id":"273","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"realnetworks","cpe5":"realone_player","cpe6":"2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2004","cve_id":"273","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"realnetworks","cpe5":"realone_player","cpe6":"2.0","cpe7":"*","cpe8":"win","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2004","cve_id":"273","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"realnetworks","cpe5":"realone_player","cpe6":"6.0.11.818","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2004","cve_id":"273","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"realnetworks","cpe5":"realone_player","cpe6":"6.0.11.830","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2004","cve_id":"273","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"realnetworks","cpe5":"realone_player","cpe6":"6.0.11.841","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2004","cve_id":"273","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"realnetworks","cpe5":"realone_player","cpe6":"6.0.11.853","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2004","cve_id":"273","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"realnetworks","cpe5":"realone_player","cpe6":"6.0.11.868","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-08T00:10:03.715Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"VU#514734","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"],"url":"http://www.kb.cert.org/vuls/id/514734"},{"name":"realoneplayer-rmp-directory-traversal(15123)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15123"},{"name":"20040210 Directory traversal in RealPlayer allows code execution","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=107642978524321&w=2"},{"name":"9580","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/9580"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://service.real.com/help/faq/security/040123_player/EN/"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2004-02-10T00:00:00.000Z","descriptions":[{"lang":"en","value":"Directory traversal vulnerability in RealOne Player, RealOne Player 2.0, and RealOne Enterprise Desktop allows remote attackers to upload arbitrary files via an RMP file that contains .. (dot dot) sequences in a .rjs skin file."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2004-08-13T00:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"VU#514734","tags":["third-party-advisory","x_refsource_CERT-VN"],"url":"http://www.kb.cert.org/vuls/id/514734"},{"name":"realoneplayer-rmp-directory-traversal(15123)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15123"},{"name":"20040210 Directory traversal in RealPlayer allows code execution","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://marc.info/?l=bugtraq&m=107642978524321&w=2"},{"name":"9580","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/9580"},{"tags":["x_refsource_CONFIRM"],"url":"http://service.real.com/help/faq/security/040123_player/EN/"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2004-0273","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Directory traversal vulnerability in RealOne Player, RealOne Player 2.0, and RealOne Enterprise Desktop allows remote attackers to upload arbitrary files via an RMP file that contains .. (dot dot) sequences in a .rjs skin file."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"VU#514734","refsource":"CERT-VN","url":"http://www.kb.cert.org/vuls/id/514734"},{"name":"realoneplayer-rmp-directory-traversal(15123)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15123"},{"name":"20040210 Directory traversal in RealPlayer allows code execution","refsource":"BUGTRAQ","url":"http://marc.info/?l=bugtraq&m=107642978524321&w=2"},{"name":"9580","refsource":"BID","url":"http://www.securityfocus.com/bid/9580"},{"name":"http://service.real.com/help/faq/security/040123_player/EN/","refsource":"CONFIRM","url":"http://service.real.com/help/faq/security/040123_player/EN/"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2004-0273","datePublished":"2004-09-01T04:00:00.000Z","dateReserved":"2004-03-17T00:00:00.000Z","dateUpdated":"2024-08-08T00:10:03.715Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2004-11-23 05:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["CWE-22","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:realnetworks:realone_desktop_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"C9200BD8-6D2F-49D4-B85B-C17D2C0F400E"},{"vulnerable":true,"criteria":"cpe:2.3:a:realnetworks:realone_enterprise_desktop:6.0.11.774:*:*:*:*:*:*:*","matchCriteriaId":"27DDB6F2-9EAF-4A77-BB3B-D3989E1D9458"},{"vulnerable":true,"criteria":"cpe:2.3:a:realnetworks:realone_player:1.0:*:*:*:*:*:*:*","matchCriteriaId":"7E940DAB-0CD5-4EC0-916F-6C0B2AE26D19"},{"vulnerable":true,"criteria":"cpe:2.3:a:realnetworks:realone_player:2.0:*:*:*:*:*:*:*","matchCriteriaId":"CF6535A6-6647-4E60-B5AA-24DFC06360AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:realnetworks:realone_player:2.0:*:win:*:*:*:*:*","matchCriteriaId":"B49F1421-2C52-4B67-BE04-A62E553E1819"},{"vulnerable":true,"criteria":"cpe:2.3:a:realnetworks:realone_player:6.0.11.818:*:*:*:*:*:*:*","matchCriteriaId":"0C6BB6A9-B0CE-4C04-8481-53B7CB195264"},{"vulnerable":true,"criteria":"cpe:2.3:a:realnetworks:realone_player:6.0.11.830:*:*:*:*:*:*:*","matchCriteriaId":"41688192-70B7-4C35-AE4F-FE116104137A"},{"vulnerable":true,"criteria":"cpe:2.3:a:realnetworks:realone_player:6.0.11.841:*:*:*:*:*:*:*","matchCriteriaId":"FA11D9CD-113B-4977-B150-D6500552222A"},{"vulnerable":true,"criteria":"cpe:2.3:a:realnetworks:realone_player:6.0.11.853:*:*:*:*:*:*:*","matchCriteriaId":"BF391DD1-2912-49BF-BC9F-B9FA3771737F"},{"vulnerable":true,"criteria":"cpe:2.3:a:realnetworks:realone_player:6.0.11.868:*:*:*:*:*:*:*","matchCriteriaId":"3908DB26-D8C4-4368-A1B6-C067085CE4B7"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2004","CveId":"273","Ordinal":"1","Title":"CVE-2004-0273","CVE":"CVE-2004-0273","Year":"2004"},"notes":[{"CveYear":"2004","CveId":"273","Ordinal":"1","NoteData":"Directory traversal vulnerability in RealOne Player, RealOne Player 2.0, and RealOne Enterprise Desktop allows remote attackers to upload arbitrary files via an RMP file that contains .. (dot dot) sequences in a .rjs skin file.","Type":"Description","Title":"CVE-2004-0273"},{"CveYear":"2004","CveId":"273","Ordinal":"2","NoteData":"2004-09-01","Type":"Other","Title":"Published"},{"CveYear":"2004","CveId":"273","Ordinal":"3","NoteData":"2004-08-12","Type":"Other","Title":"Modified"}]}}}