Unscored severity · published Apr 11, 2003
CVE-2002-1442
The Google toolbar 1.1.58 and earlier allows remote web sites to perform unauthorized toolbar operations including script execution and file reading in other zones such as "My…
–
CVSS
1.4%
EPSS
No
On KEV
Description
The Google toolbar 1.1.58 and earlier allows remote web sites to perform unauthorized toolbar operations including script execution and file reading in other zones such as "My Computer" by opening a window to tools.google.com or the res: protocol, then using script to modify the window's location to the toolbar's configuration URL, which bypasses the origin verification check.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
Toolbar · Google
1.1.41; 1.1.42; 1.1.43; 1.1.44; 1.1.45; 1.1.47; +8 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-1442
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-1442
archives.neohapsis.com
http://archives.neohapsis.com/archives/ntbugtraq/2002-q3/0066.html
Exploit
http://online.securityfocus.com/archive/1/286527
sec.greymagic.com
http://sec.greymagic.com/adv/gm001-mc/
Exploit
http://www.securityfocus.com/bid/5424
More from Toolbar
–
CVE-2007-6536
The Custom Button Installer dialog in Google Toolbar 4 and 5 beta presents certain domain names in the (1) "Downloaded from" and (2) "Privacy considerations" sections without…
–
CVE-2004-2475
Cross-site scripting (XSS) vulnerability in Google Toolbar 2.0.114.1 allows remote attackers to inject arbitrary web script via about.html in the About section
–
CVE-2002-1443
The Google toolbar 1.1.58 and earlier allows remote web sites to monitor a user's input into the toolbar via an "onkeydown" event handler
–
CVE-2002-1444
The Google toolbar 1.1.60, when running on Internet Explorer 5.5 and 6.0, allows remote attackers to cause a denial of service (crash with an exception in oleaut32.dll) via…