{"id": "CVE-2002-0727", "bulletinFamily": "NVD", "title": "CVE-2002-0727", "description": "The Host function in Microsoft Office Web Components (OWC) 2000 and 2002 is exposed in components that are marked as safe for scripting, which allows remote attackers to execute arbitrary commands via the setTimeout method.", "published": "2002-09-24T04:00:00", "modified": "2018-10-12T21:31:00", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-0727", "reporter": "cve@mitre.org", "references": ["http://marc.info/?l=bugtraq&m=101829645415486&w=2", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-044", "http://www.securityfocus.com/bid/4449", "http://www.osvdb.org/3006", "http://www.iss.net/security_center/static/8777.php"], "cvelist": ["CVE-2002-0727"], "type": "cve", "lastseen": "2021-02-02T05:19:06", "edition": 4, "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "osvdb", "idList": ["OSVDB:3006"]}], "modified": "2021-02-02T05:19:06", "rev": 2}, "score": {"value": 6.9, "vector": "NONE", "modified": "2021-02-02T05:19:06", "rev": 2}, "vulnersScore": 6.9}, "cpe": ["cpe:/a:microsoft:office_web_components:2000", "cpe:/a:microsoft:project:2002", "cpe:/a:microsoft:office_web_components:2002"], "affectedSoftware": [{"cpeName": "microsoft:project", "name": "microsoft project", "operator": "eq", "version": "2002"}, {"cpeName": "microsoft:office_web_components", "name": "microsoft office web components", "operator": "eq", "version": "2002"}, {"cpeName": "microsoft:office_web_components", "name": "microsoft office web components", "operator": "eq", "version": "2000"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": true, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:a:microsoft:office_web_components:2000:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:project:2002:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:office_web_components:2002:*:*:*:*:*:*:*"], "cwe": ["NVD-CWE-Other"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:office_web_components:2000:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:project:2002:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:office_web_components:2002:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "extraReferences": [{"name": "3006", "refsource": "OSVDB", "tags": [], "url": "http://www.osvdb.org/3006"}, {"name": "4449", "refsource": "BID", "tags": [], "url": "http://www.securityfocus.com/bid/4449"}, {"name": "owc-spreadsheet-host-script-execution (8777)", "refsource": "XF", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.iss.net/security_center/static/8777.php"}, {"name": "20020408 Scripting for the scriptless with OWC in IE (GM#005-IE)", "refsource": "BUGTRAQ", "tags": [], "url": "http://marc.info/?l=bugtraq&m=101829645415486&w=2"}, {"name": "MS02-044", "refsource": "MS", "tags": [], "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-044"}]}

{"osvdb": [{"lastseen": "2017-04-28T13:19:57", "bulletinFamily": "software", "cvelist": ["CVE-2002-0727"], "edition": 1, "description": "## Vulnerability Description\nMicrosoft Office Web Components (OWC) contain a flaw that allows a remote attacker to execute arbitrary scripts when called via Internet Explorer. The flaw is due to components that are marked as \"safe\" for scripting which allow arbitrary commands to be executed via the \"setTimeout\" function. An attacker who created a malicious HTML document could use this function along with \"\"=HOST()\" to change the Document Object Model (DOM) and execute the arbitrary script.\n\n\n## Solution Description\nCurrently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.\n## Short Description\nMicrosoft Office Web Components (OWC) contain a flaw that allows a remote attacker to execute arbitrary scripts when called via Internet Explorer. The flaw is due to components that are marked as \"safe\" for scripting which allow arbitrary commands to be executed via the \"setTimeout\" function. An attacker who created a malicious HTML document could use this function along with \"\"=HOST()\" to change the Document Object Model (DOM) and execute the arbitrary script.\n\n\n## References:\nVendor Specific Solution URL: http://office.microsoft.com/downloads/2002/owc10.aspx\nMicrosoft Security Bulletin: MS02-044\nISS X-Force ID: 8777\nGeneric Informational URL: http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21023\nGeneric Informational URL: http://security.greymagic.com/adv/gm005-ie/\n[CVE-2002-0727](https://vulners.com/cve/CVE-2002-0727)\nBugtraq ID: 4449\n", "modified": "2002-03-10T00:00:00", "published": "2002-03-10T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:3006", "id": "OSVDB:3006", "title": "Microsoft IE OWC Script Execution", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}