CVE-2002-0727

The Host function in Microsoft Office Web Components (OWC) 2000 and 2002 is exposed in components that are marked as safe for scripting, which allows remote attackers to execute arbitrary commands via the setTimeout method.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://marc.info/?l=bugtraq&m=101829645415486&w=2
http://www.iss.net/security_center/static/8777.php	Patch Vendor Advisory
http://www.osvdb.org/3006
http://www.securityfocus.com/bid/4449
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-044

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:office_web_components:2000:::::::*
	cpe:2.3:a:microsoft:office_web_components:2002:::::::*
	cpe:2.3:a:microsoft:project:2002:::::::*

History

No history.

Information

Published : 2002-09-24 04:00

Updated : 2024-02-04 16:31

NVD link : CVE-2002-0727

Mitre link : CVE-2002-0727

CVE.ORG link : CVE-2002-0727

JSON object : View

Products Affected

microsoft

project
office_web_components

CWE

NVD-CWE-Other

{"id": "CVE-2002-0727", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": true, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2002-09-24T04:00:00.000", "references": [{"url": "http://marc.info/?l=bugtraq&m=101829645415486&w=2", "source": "cve@mitre.org"}, {"url": "http://www.iss.net/security_center/static/8777.php", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/3006", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/4449", "source": "cve@mitre.org"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-044", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The Host function in Microsoft Office Web Components (OWC) 2000 and 2002 is exposed in components that are marked as safe for scripting, which allows remote attackers to execute arbitrary commands via the setTimeout method."}, {"lang": "es", "value": "La funci\u00f3n de Host en Microsoft Office Web Componentes (OWC) 2000 y 2002 est\u00e1 expuesta en componentes marcados como seguros para secuencias de comandos (scripting), lo que permite a atacantes ejecutar comandos arbitrarios mediante el m\u00e9todo setTimeout."}], "lastModified": "2018-10-12T21:31:47.910", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office_web_components:2000:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A431CA59-8BD3-48CB-82BC-8FDCFE7440FA"}, {"criteria": "cpe:2.3:a:microsoft:office_web_components:2002:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "316D6CD7-3B2B-499C-ADBE-088981DFD306"}, {"criteria": "cpe:2.3:a:microsoft:project:2002:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2AE2D3E0-49E4-410E-B63A-753BDE8995BB"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}