Unscored severity · published Mar 8, 2002
CVE-2002-0057
XMLHTTP control in Microsoft XML Core Services 2.6 and later does not properly handle IE Security Zone settings, which allows remote attackers to read arbitrary files by…
–
CVSS
23.2%
EPSS
No
On KEV
Description
XMLHTTP control in Microsoft XML Core Services 2.6 and later does not properly handle IE Security Zone settings, which allows remote attackers to read arbitrary files by specifying a local file as an XML Data Source.
Exploitation
Is it being used?
Exploit prediction (EPSS)23.2% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IE
Internet Explorer · Microsoft
6.0 · source: NVD
SS
Sql Server · Microsoft
2000; 2000; 2000 · source: NVD
WX
Windows XP · Microsoft
All versions, or not specified · source: NVD
XC
Xml Core Services · Microsoft
2.6; 3.0; 4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-0057
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-0057
Vendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2001-12/0152.html
marc.info
http://marc.info/?l=bugtraq&m=101366383408821&w=2
www.osvdb.org
http://www.osvdb.org/3032
www.securityfocus.com
http://www.securityfocus.com/bid/3699
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-008
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/7712
More from Internet Explorer
9.8
CVE-2015-0313
Adobe Flash Player Use-After-Free Vulnerability
9.8
CVE-2015-0311
Adobe Flash Player Remote Code Execution Vulnerability
9.8
CVE-2014-1776
Microsoft Internet Explorer Memory Corruption Vulnerability
8.8
CVE-2021-27085
Internet Explorer Remote Code Execution Vulnerability
8.8
CVE-2021-26411
Internet Explorer Memory Corruption Vulnerability