CVE-2002-0057 - Vulnerability Details - OpenCVE

XMLHTTP control in Microsoft XML Core Services 2.6 and later does not properly handle IE Security Zone settings, which allows remote attackers to read arbitrary files by specifying a local file as an XML Data Source.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.41761.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft Subscribe	Internet Explorer Subscribe Sql Server Subscribe Windows Xp Subscribe Xml Core Services Subscribe

Configuration 1 [-]

OR	cpe:2.3:a:microsoft:internet_explorer:6.0:::::::*
	cpe:2.3:a:microsoft:sql_server:2000:::::::*
	cpe:2.3:a:microsoft:sql_server:2000:sp1::::::
	cpe:2.3:a:microsoft:sql_server:2000:sp2::::::
	cpe:2.3:a:microsoft:xml_core_services:2.6:::::::*
	cpe:2.3:a:microsoft:xml_core_services:3.0:::::::*
	cpe:2.3:a:microsoft:xml_core_services:4.0:::::::*

Configuration 2 [-]

OR	cpe:2.3:o:microsoft:windows_xp:::home:::::*
	cpe:2.3:o:microsoft:windows_xp::gold:professional:::::

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://archives.neohapsis.com/archives/bugtraq/2001-12/0152.html
http://marc.info/?l=bugtraq&m=101366383408821&w=2
http://www.osvdb.org/3032
http://www.securityfocus.com/bid/3699
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-008
https://exchange.xforce.ibmcloud.com/vulnerabilities/7712

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2002-06-25T04:00:00

Updated: 2024-08-08T02:35:17.423Z

Reserved: 2002-02-02T00:00:00

Link: CVE-2002-0057

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2002-03-08T05:00:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2002-0057

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

NVD-CWE-Other

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2001-12-14T00:00:00", "descriptions": [{"lang": "en", "value": "XMLHTTP control in Microsoft XML Core Services 2.6 and later does not properly handle IE Security Zone settings, which allows remote attackers to read arbitrary files by specifying a local file as an XML Data Source."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2002-06-16T00:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "ie-xmlhttp-redirect(7712)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/7712"}, {"name": "3699", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/3699"}, {"name": "20011214 MSIE6 can read local files", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://archives.neohapsis.com/archives/bugtraq/2001-12/0152.html"}, {"name": "MS02-008", "tags": ["vendor-advisory", "x_refsource_MS"], "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-008"}, {"name": "3032", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/3032"}, {"name": "20020212 Update on the MS02-005 patch, holes still remain", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://marc.info/?l=bugtraq&m=101366383408821&w=2"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2002-0057", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "XMLHTTP control in Microsoft XML Core Services 2.6 and later does not properly handle IE Security Zone settings, which allows remote attackers to read arbitrary files by specifying a local file as an XML Data Source."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "ie-xmlhttp-redirect(7712)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/7712"}, {"name": "3699", "refsource": "BID", "url": "http://www.securityfocus.com/bid/3699"}, {"name": "20011214 MSIE6 can read local files", "refsource": "BUGTRAQ", "url": "http://archives.neohapsis.com/archives/bugtraq/2001-12/0152.html"}, {"name": "MS02-008", "refsource": "MS", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-008"}, {"name": "3032", "refsource": "OSVDB", "url": "http://www.osvdb.org/3032"}, {"name": "20020212 Update on the MS02-005 patch, holes still remain", "refsource": "BUGTRAQ", "url": "http://marc.info/?l=bugtraq&m=101366383408821&w=2"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-08T02:35:17.423Z"}, "title": "CVE Program Container", "references": [{"name": "ie-xmlhttp-redirect(7712)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/7712"}, {"name": "3699", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/3699"}, {"name": "20011214 MSIE6 can read local files", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://archives.neohapsis.com/archives/bugtraq/2001-12/0152.html"}, {"name": "MS02-008", "tags": ["vendor-advisory", "x_refsource_MS", "x_transferred"], "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-008"}, {"name": "3032", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/3032"}, {"name": "20020212 Update on the MS02-005 patch, holes still remain", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=101366383408821&w=2"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2002-0057", "datePublished": "2002-06-25T04:00:00", "dateReserved": "2002-02-02T00:00:00", "dateUpdated": "2024-08-08T02:35:17.423Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "A19F6133-25D1-44A5-B6B9-354703436783", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:sql_server:2000:*:*:*:*:*:*:*", "matchCriteriaId": "A5D559EE-727C-405C-987C-247973A84D32", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:sql_server:2000:sp1:*:*:*:*:*:*", "matchCriteriaId": "4A74EBC1-FD61-4DD1-AC8A-E4B0F333A980", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:sql_server:2000:sp2:*:*:*:*:*:*", "matchCriteriaId": "4BC2A389-68BF-45B1-833D-96B331844424", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:xml_core_services:2.6:*:*:*:*:*:*:*", "matchCriteriaId": "F3293EF7-6545-467A-9A0F-A34F4C2141AA", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:xml_core_services:3.0:*:*:*:*:*:*:*", "matchCriteriaId": "73052210-0B42-46AA-9F28-AAE3E9B6DE87", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:xml_core_services:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "3C9B9BE3-6F83-469E-834F-3E00CFECD8E2", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_xp:*:*:home:*:*:*:*:*", "matchCriteriaId": "BC176BB0-1655-4BEA-A841-C4158167CC9B", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:*:gold:professional:*:*:*:*:*", "matchCriteriaId": "4BF263CB-4239-4DB0-867C-9069ED02CAD7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "XMLHTTP control in Microsoft XML Core Services 2.6 and later does not properly handle IE Security Zone settings, which allows remote attackers to read arbitrary files by specifying a local file as an XML Data Source."}, {"lang": "es", "value": "El control XMLHTTP en Microsoft XML Core Services 2.6 y versiones posteriores no manejan adecuadamente el establecimiento de valores de la Zona de Seguridad del IE, lo cual permite a atacantes remotos la lectura arbitraria de ficheros especificando un fichero local como una fuente de datos XML."}], "id": "CVE-2002-0057", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2002-03-08T05:00:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://archives.neohapsis.com/archives/bugtraq/2001-12/0152.html"}, {"source": "cve@mitre.org", "url": "http://marc.info/?l=bugtraq&m=101366383408821&w=2"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/3032"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/3699"}, {"source": "cve@mitre.org", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-008"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/7712"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://archives.neohapsis.com/archives/bugtraq/2001-12/0152.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=bugtraq&m=101366383408821&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/3032"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/3699"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-008"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/7712"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}