PT-2002-2172 · Microsoft · Internet Explorer

Published 2002-12-11 · Updated 2021-07-23 · CVE-2002-1188

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Internet Explorer versions 5.01 through 6.0

Description: The issue allows remote attackers to identify the path to the Temporary Internet Files folder and obtain user information, such as cookies, via certain uses of the OBJECT tag. This occurs because the OBJECT tag is not subjected to the proper security checks.

Recommendations: For Internet Explorer versions 5.01 through 6.0, consider disabling the use of the OBJECT tag until a patch is available. Restrict access to sensitive user information to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-1188

Affected Products

Internet Explorer

References · 8

• http://iss.net/security_center/static/10665.php · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-066 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1188 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A690 · Note
• http://marc.info/?l=bugtraq&m=103184415307193&w=2 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A444 · Note
• http://securityfocus.com/bid/6217 · Note
• http://ciac.org/ciac/bulletins/n-018.shtml · Note