CVE-2002-1143

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Microsoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when the document is returned to the attacker, as demonstrated in Word using (1) INCLUDETEXT or (2) INCLUDEPICTURE, aka "Flaw in Word Fields and Excel External Updates Could Lead to Information Disclosure."

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=103040003014999&w=2Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=103252858816401&w=2Mailing List, Third Party Advisory
http://www.iss.net/security_center/static/10008.phpBroken Link
http://www.iss.net/security_center/static/10155.phpBroken Link
http://www.kb.cert.org/vuls/id/899713Third Party Advisory, US Government Resource
http://www.microsoft.com/technet/treeview/default.asp?url=/Technet/security/topics/secword.aspPatch, Vendor Advisory
http://www.securityfocus.com/bid/5586Exploit, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
http://www.securityfocus.com/bid/5764Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-059
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A202Third Party Advisory
http://marc.info/?l=bugtraq&m=103040003014999&w=2Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=103252858816401&w=2Mailing List, Third Party Advisory
http://www.iss.net/security_center/static/10008.phpBroken Link
http://www.iss.net/security_center/static/10155.phpBroken Link
http://www.kb.cert.org/vuls/id/899713Third Party Advisory, US Government Resource
http://www.microsoft.com/technet/treeview/default.asp?url=/Technet/security/topics/secword.aspPatch, Vendor Advisory
http://www.securityfocus.com/bid/5586Exploit, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
http://www.securityfocus.com/bid/5764Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-059
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A202Third Party Advisory

Timeline

Published: Apr 11, 2003
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-114510.0The xp_runwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, Microsoft Data Engine (MSDE) 1.0, and Mi CVE-2002-11465.0The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, use the maximum CVE-2002-11477.1The HTTP administration interface for HP Procurve 4000M Switch firmware before C.09.16, with stacking features and remote administration ena CVE-2002-11485.0The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read sou CVE-2002-11495.0The installation procedure for Invision Board suggests that users install the phpinfo.php program under the web root, which leaks sensitive CVE-2002-11504.6The Remote Desktop Sharing (RDS) Screen Saver Protection capability for Microsoft NetMeeting 3.01 through SP2 (4.4.3396) allows attackers wi CVE-2002-11517.5The cross-site scripting protection for Konqueror in KDE 2.2.2 and 3.0 through 3.0.3 does not properly initialize the domains on sub-frames CVE-2002-11527.5Konqueror in KDE 3.0 through 3.0.2 does not properly detect the "secure" flag in an HTTP cookie, which could cause Konqueror to send the coo CVE-2002-11535.0IBM Websphere 4.0.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP request wit CVE-2002-11545.0anlgform.pl in Analog before 5.23 does not restrict access to the PROGRESSFREQ progress update command, which allows remote attackers to cau CVE-2002-11557.2Buffer overflow in KON kon2 0.3.9b and earlier allows local users to execute arbitrary code via a long -Coding command line argument.CVE-2002-11565.0Apache 2.0.42 allows remote attackers to view the source code of a CGI script via a POST request to a directory with both WebDAV and CGI ena