PT-2002-2171 · Microsoft · Internet Explorer

Published 2002-12-11 · Updated 2021-07-23 · CVE-2002-1187

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Internet Explorer versions 5.01 through 6.0

Description: A cross-site scripting issue allows remote attackers to read and execute files on the local system via web pages using the or element and javascript. This can be achieved by utilizing resources such as PrivacyPolicy.dlg.

Recommendations: For Internet Explorer versions 5.01 through 6.0, consider disabling the use of <frame> and <iframe> elements in web pages until a fix is available. As a temporary workaround, restrict the execution of javascript in these versions to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2002-1187

Affected Products

Internet Explorer

References · 9

• 🔥 https://exploit-db.com/exploits/21777 · Exploit
• http://iss.net/security_center/static/10066.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1187 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-066 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=103158601431054&w=2 · Note
• http://osvdb.org/2998 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A225 · Note
• http://securityfocus.com/bid/5672 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A203 · Note