CVE-2002-0861

Microsoft Office Web Components (OWC) 2000 and 2002 allows remote attackers to bypass the "Allow paste operations via script" setting, even when it is disabled, via the (1) Copy method of the Cell object or (2) the Paste method of the Range object.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://marc.info/?l=bugtraq&m=101829726516346&w=2
http://www.iss.net/security_center/static/8779.php	Patch Vendor Advisory
http://www.securityfocus.com/bid/4457
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-044

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:office_web_components:2000:::::::*
	cpe:2.3:a:microsoft:office_web_components:2002:::::::*
	cpe:2.3:a:microsoft:project:2000:::::::*
	cpe:2.3:a:microsoft:project:2002:::::::*

History

No history.

Information

Published : 2002-09-24 04:00

Updated : 2024-02-04 16:31

NVD link : CVE-2002-0861

Mitre link : CVE-2002-0861

CVE.ORG link : CVE-2002-0861

JSON object : View

Products Affected

microsoft

project
office_web_components

CWE

NVD-CWE-Other

{"id": "CVE-2002-0861", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": true, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2002-09-24T04:00:00.000", "references": [{"url": "http://marc.info/?l=bugtraq&m=101829726516346&w=2", "source": "cve@mitre.org"}, {"url": "http://www.iss.net/security_center/static/8779.php", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/4457", "source": "cve@mitre.org"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-044", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Microsoft Office Web Components (OWC) 2000 and 2002 allows remote attackers to bypass the \"Allow paste operations via script\" setting, even when it is disabled, via the (1) Copy method of the Cell object or (2) the Paste method of the Range object."}, {"lang": "es", "value": "Microsoft Office Web Components (OWC) 2000 y 2002 permite a atacantes remotos sortear la configuraci\u00f3n de \"Permitir pegar mediante script\", incluso cuando est\u00e1 desactivada, mediante:\r\nel m\u00e9todo Copy del objeto Cell (celda)\r\nel m\u00e9todo Paste (pegar) del objeto Range (rango)"}], "lastModified": "2018-10-12T21:31:48.847", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office_web_components:2000:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A431CA59-8BD3-48CB-82BC-8FDCFE7440FA"}, {"criteria": "cpe:2.3:a:microsoft:office_web_components:2002:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "316D6CD7-3B2B-499C-ADBE-088981DFD306"}, {"criteria": "cpe:2.3:a:microsoft:project:2000:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F09162C-01F0-4056-94D3-995713F92AE9"}, {"criteria": "cpe:2.3:a:microsoft:project:2002:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2AE2D3E0-49E4-410E-B63A-753BDE8995BB"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}