Vulnerability in Microsoft Excel
CVE-2002-1143
Microsoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when the document is returned to the attacker, as demonstrated in Word using (1) INCLUDETEXT or (2) INCLUDEPICTURE, aka "Flaw in Word Fields and Excel External Updates Could Lead to Information Disclosure."
Published · last modified .
CVSS v2 metric
CVSS v2 base score 5.0 (Medium). Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.536 (99.0th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.536 · newest: 0.536 · change: 0.000
Affected products
- Microsoft Excel — versions 2002
- Microsoft Word — versions 97, 98, 2000
References
- marc.info/ (mailing-list, Mailing List, Third Party Advisory)
- docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-059 (vendor-advisory)
- www.securityfocus.com/bid/5764 (VDB Entry, Third Party Advisory, vdb-entry)
- www.iss.net/security_center/static/10008.php (vdb-entry, Broken Link)
- www.iss.net/security_center/static/10155.php (vdb-entry, Broken Link)
- oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:202 (signature, Third Party Advisory, vdb-entry)
- www.securityfocus.com/bid/5586 (Exploit, Patch, VDB Entry, Third Party Advisory, vdb-entry, Vendor Advisory)
- www.kb.cert.org/vuls/id/899713 (US Government Resource, Third Party Advisory, third-party-advisory)
- marc.info/ (mailing-list, Mailing List, Third Party Advisory)
- www.microsoft.com/technet/treeview/default.asp (Patch, Vendor Advisory)