CVE-2002-1143 Microsoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when the document is returned to the attacker, as demonstrated in Wor...
MediumCVSS 5.0
EPSS 53.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Microsoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when the document is returned to the attacker, as demonstrated in Word using (1) INCLUDETEXT or (2) INCLUDEPICTURE, aka "Flaw in Word Fields and Excel External Updates Could Lead to Information Disclosure."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft excel | = 2002 | No fix listed |
| Microsoft excel | = 2002-sp1 | No fix listed |
| Microsoft excel | = 2002-sp2 | No fix listed |
| Microsoft word | All versions | No fix listed |
| Microsoft word | = 97 | No fix listed |
| Microsoft word | = 97-sr1 | No fix listed |
| Microsoft word | = 97-sr2 | No fix listed |
| Microsoft word | = 98 | No fix listed |
| Microsoft word | = 2000 | No fix listed |
| Microsoft word | = 2000-sp2 | No fix listed |
| Microsoft word | = 2000-sr1 | No fix listed |
| Microsoft word | = 2000-sr1a | No fix listed |
| Microsoft word | = 2001 | No fix listed |
| Microsoft word | = 2002 | No fix listed |
| Microsoft word | = 2002-sp1 | No fix listed |
| Microsoft word | = 2002-sp2 | No fix listed |
References
- 20020826 Security side-effects of Word fields mailing-list third-party-advisory
- 20020919 More vulnerabilities (Re: Security side-effects of Word fields) mailing-list third-party-advisory
- word-includetext-read-files(10008) broken-link vdb-entry
- word-includepicture-read-files(10155) broken-link vdb-entry
- VU#899713 third-party-advisory us-government-resource
- www.microsoft.com patch vendor-advisory
- 5586 exploit patch third-party-advisory vdb-entry vendor-advisory
- 5764 third-party-advisory vdb-entry
- MS02-059 vendor-advisory
- oval:org.mitre.oval:def:202 signature third-party-advisory vdb-entry