Vulnerability in Microsoft Virtual Machine
CVE-2002-0058
Vulnerability in Java Runtime Environment (JRE) allows remote malicious web sites to hijack or sniff a web client's sessions, when an HTTP proxy is being used, via a Java applet that redirects the session to another server, as seen in (1) Netscape 6.0 through 6.1 and 4.79 and earlier, (2) Microsoft VM build 3802 and earlier as used in Internet Explorer 4.x and 5.x, and possibly other implementations that use vulnerable versions of SDK or JDK.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 5.0 (Medium). Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.086 (94.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 94.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.086 · newest: 0.086 · change: 0.000
Affected products
- Microsoft Virtual Machine — versions 3802
- Sun Jdk — versions 1.1.8
- Sun Jre — versions 1.1.8, 1.2.2, 1.3.0
- Sun Sdk — versions 1.1.8_007, 1.2.2_10, 1.2.2_010
References
- docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-013 (vendor-advisory)
- sunsolve.sun.com/pub-cgi/retrieve.pl (vendor-advisory)
- marc.info/ (mailing-list)