CVE-2002-0188
Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 16.3%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error message, aka the second variant of the "Content Disposition" vulnerability.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 16.35% probability · 97th percentile
- CISA KEV
- Not listed
- Affected
- microsoft/internet explorer
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/bugtraq/2002-05/0126.html
- http://www.iss.net/security_center/static/9086.phpVendor Advisory
- http://www.lac.co.jp/security/english/snsadv_e/48_e.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-023
- http://archives.neohapsis.com/archives/bugtraq/2002-05/0126.html
- http://www.iss.net/security_center/static/9086.phpVendor Advisory
- http://www.lac.co.jp/security/english/snsadv_e/48_e.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-023
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.