CVE-2002-1143

35Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 54%

from disclosure to weapon0 days

Published on NVDApr 3

1st PoCAug 26

exploitation probability

54%top 1% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Microsoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when the document is returned to the attacker, as demonstrated in Word using (1) INCLUDETEXT or (2) INCLUDEPICTURE, aka "Flaw in Word Fields and Excel External Updates Could Lead to Information Disclosure."

Affected products

n/a · n/a

public PoCs found — 2✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/21812 exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/21764

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://marc.info/?l=bugtraq&m=103040003014999&w=2 http://marc.info/?l=bugtraq&m=103252858816401&w=2 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-059 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A202 http://www.iss.net/security_center/static/10008.php http://www.iss.net/security_center/static/10155.php http://www.kb.cert.org/vuls/id/899713 http://www.microsoft.com/technet/treeview/default.asp?url=/Technet/security/topics/secword.asp http://www.securityfocus.com/bid/5586 http://www.securityfocus.com/bid/5764