CVE-2002-1145
The xp_runwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, Microsoft Data Engine (MSDE) 1.0, and Microsoft Desktop Engine (MSDE) 2000 can be executed by PUBLIC, which allows an attacker to gain privileges by…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (8.34%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The xp_runwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, Microsoft Data Engine (MSDE) 1.0, and Microsoft Desktop Engine (MSDE) 2000 can be executed by PUBLIC, which allows an attacker to gain privileges by updating a webtask that is owned by the database owner through the msdb.dbo.mswebtasks table, which does not have strong permissions.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 8.34% probability · 95th percentile
- CISA KEV
- Not listed
- Affected
- microsoft/data engine · microsoft/sql server
- Source
- cve@mitre.org
References
- http://marc.info/?l=bugtraq&m=103487044122900&w=2
- http://marc.info/?l=ntbugtraq&m=103486356413404&w=2
- http://www.cisco.com/warp/public/707/cisco-sa-20030126-ms02-061.shtml
- http://www.iss.net/security_center/static/10388.phpVendor Advisory
- http://www.nextgenss.com/advisories/mssql-webtasks.txt
- http://www.securityfocus.com/bid/5980
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-061
- http://marc.info/?l=bugtraq&m=103487044122900&w=2
- http://marc.info/?l=ntbugtraq&m=103486356413404&w=2
- http://www.cisco.com/warp/public/707/cisco-sa-20030126-ms02-061.shtml
- http://www.iss.net/security_center/static/10388.phpVendor Advisory
- http://www.nextgenss.com/advisories/mssql-webtasks.txt
- http://www.securityfocus.com/bid/5980
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-061
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.