PT-2002-1749 · Microsoft · Office Web Components

Publicado 2002-09-24 · Atualizado 2018-10-12 · CVE-2002-0727

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Office Web Components (OWC) versions 2000 through 2002

Description The issue concerns the Host function in Microsoft Office Web Components, which is exposed in components marked as safe for scripting. This exposure allows remote attackers to execute arbitrary commands via the setTimeout method.

Recommendations For Microsoft Office Web Components (OWC) versions 2000 through 2002, consider disabling the Host function in components marked as safe for scripting as a temporary workaround until a patch is available. Restrict access to the setTimeout method to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2002-0727

Produtos afetados

Office Web Components

Referências · 6

• http://osvdb.org/3006 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0727 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=101829645415486&w=2 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-044 · Aviso do Fabricante
• http://iss.net/security_center/static/8777.php · Aviso do Fabricante
• http://securityfocus.com/bid/4449 · Nota