Lucene search

MitreCVE-2002-0057

HistoryJun 25, 2002 - 4:00 a.m.

CVE-2002-0057

2002-06-2504:00:00

mitre

web.nvd.nist.gov

microsoft

xml

core services

xmlhttp

ie security zone

cve-2002-0057

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.4

Confidence

Low

EPSS

0.028

Percentile

90.6%

JSON

XMLHTTP control in Microsoft XML Core Services 2.6 and later does not properly handle IE Security Zone settings, which allows remote attackers to read arbitrary files by specifying a local file as an XML Data Source.

Affected configurations

Nvd

Node

microsoftinternet_explorerMatch6.0

microsoftsql_serverMatch2000

microsoftsql_serverMatch2000sp1

microsoftsql_serverMatch2000sp2

microsoftxml_core_servicesMatch2.6

microsoftxml_core_servicesMatch3.0

microsoftxml_core_servicesMatch4.0

Node

microsoftwindows_xphome

microsoftwindows_xpgoldprofessional

VendorProductVersionCPE
microsoftinternet_explorer6.0cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*
microsoftsql_server2000cpe:2.3:a:microsoft:sql_server:2000:*:*:*:*:*:*:*
microsoftsql_server2000cpe:2.3:a:microsoft:sql_server:2000:sp1:*:*:*:*:*:*
microsoftsql_server2000cpe:2.3:a:microsoft:sql_server:2000:sp2:*:*:*:*:*:*
microsoftxml_core_services2.6cpe:2.3:a:microsoft:xml_core_services:2.6:*:*:*:*:*:*:*
microsoftxml_core_services3.0cpe:2.3:a:microsoft:xml_core_services:3.0:*:*:*:*:*:*:*
microsoftxml_core_services4.0cpe:2.3:a:microsoft:xml_core_services:4.0:*:*:*:*:*:*:*
microsoftwindows_xp*cpe:2.3:o:microsoft:windows_xp:*:*:home:*:*:*:*:*
microsoftwindows_xp*cpe:2.3:o:microsoft:windows_xp:*:gold:professional:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	internet_explorer	6.0	cpe:2.3:a:microsoft:internet_explorer:6.0:::::::*
microsoft	sql_server	2000	cpe:2.3:a:microsoft:sql_server:2000:::::::*
microsoft	sql_server	2000	cpe:2.3:a:microsoft:sql_server:2000:sp1::::::
microsoft	sql_server	2000	cpe:2.3:a:microsoft:sql_server:2000:sp2::::::
microsoft	xml_core_services	2.6	cpe:2.3:a:microsoft:xml_core_services:2.6:::::::*
microsoft	xml_core_services	3.0	cpe:2.3:a:microsoft:xml_core_services:3.0:::::::*
microsoft	xml_core_services	4.0	cpe:2.3:a:microsoft:xml_core_services:4.0:::::::*
microsoft	windows_xp	*	cpe:2.3:o:microsoft:windows_xp:::home:::::*
microsoft	windows_xp	*	cpe:2.3:o:microsoft:windows_xp::gold:professional:::::

References

archives.neohapsis.com/archives/bugtraq/2001-12/0152.html

marc.info/?l=bugtraq&m=101366383408821&w=2

www.osvdb.org/3032

www.securityfocus.com/bid/3699

docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-008

exchange.xforce.ibmcloud.com/vulnerabilities/7712

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.4

Confidence

Low

EPSS

0.028

Percentile

90.6%

JSON

Related for CVE-2002-0057