{"id":"CVE-2002-0862","url":"https://www.cyber-defence.io/tools/cve/CVE-2002-0862","generatedAt":"2026-10-27T21:40:43.087Z","title":"The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for…","description":"The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.","published":"2002-10-04T04:00:00.000Z","lastModified":"2026-06-16T21:58:17.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":6.8,"severity":"MEDIUM","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P"},"cwe":["CWE-295"],"affected":["microsoft/windows 2000","microsoft/windows 98","microsoft/windows 98se","microsoft/windows me","microsoft/windows nt","microsoft/windows xp","microsoft/internet explorer","microsoft/office","microsoft/outlook express"],"epss":{"score":0.1576,"percentile":0.96845,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":true,"firstPublished":"2002-08-06","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":21692,"kind":"exploit","title":"Microsoft Internet Explorer 5/6 / Konqueror 2.2.2/3.0 / Weblogic Server 5/6/7 - Invalid X.509 Certificate Chain","url":"https://www.exploit-db.com/exploits/21692","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/remote/21692.txt","file":"exploits/windows/remote/21692.txt","published":"2002-08-06","added":"2002-08-06","updated":"2012-10-08","author":"Mike Benham","type":"remote","platform":"windows","port":null,"verified":true,"codes":["CVE-2002-1183","OSVDB-865","CVE-2002-0862","CVE-2002-0828"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/5410/info"}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 15.8%, higher than 97% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://marc.info/?l=bugtraq&m=102866120821995&w=2","tags":["Mailing List"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=102918200405308&w=2","tags":["Mailing List"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=102976967730450&w=2","tags":["Mailing List"],"source":"cve@mitre.org"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-050","tags":["Patch","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/9776","tags":["Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1056","tags":["Broken Link"],"source":"cve@mitre.org"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1332","tags":["Broken Link"],"source":"cve@mitre.org"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2671","tags":["Broken Link"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=102866120821995&w=2","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://marc.info/?l=bugtraq&m=102918200405308&w=2","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://marc.info/?l=bugtraq&m=102976967730450&w=2","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-050","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/9776","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1056","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1332","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2671","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2002-0862","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}