CVE-2002-0057

2002-06-2504:00:00

[email protected]

web.nvd.nist.gov

microsoft

xml

core services

xmlhttp

ie security zone

cve-2002-0057

nvd

6.4 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.028 Low

EPSS

Percentile

90.6%

JSON

XMLHTTP control in Microsoft XML Core Services 2.6 and later does not properly handle IE Security Zone settings, which allows remote attackers to read arbitrary files by specifying a local file as an XML Data Source.

Affected configurations

NVD

Node

microsoftinternet_explorerMatch6.0

microsoftsql_serverMatch2000

microsoftsql_serverMatch2000sp1

microsoftsql_serverMatch2000sp2

microsoftxml_core_servicesMatch2.6

microsoftxml_core_servicesMatch3.0

microsoftxml_core_servicesMatch4.0

Node

microsoftwindows_xphome

microsoftwindows_xpgoldprofessional

CPENameOperatorVersion
microsoft:internet_explorermicrosoft internet explorereq6.0
microsoft:sql_servermicrosoft sql servereq2000
microsoft:xml_core_servicesmicrosoft xml core serviceseq2.6
microsoft:xml_core_servicesmicrosoft xml core serviceseq3.0
microsoft:xml_core_servicesmicrosoft xml core serviceseq4.0

CPE	Name	Operator	Version
microsoft:internet_explorer	microsoft internet explorer	eq	6.0
microsoft:sql_server	microsoft sql server	eq	2000
microsoft:xml_core_services	microsoft xml core services	eq	2.6
microsoft:xml_core_services	microsoft xml core services	eq	3.0
microsoft:xml_core_services	microsoft xml core services	eq	4.0