7.5

CVE-2002-1138

EPSS 11.4%
Published 11.10.2002 04:00:00
Last modified 03.04.2025 01:03:51
Source cve@mitre.org
Teams watchlist Login
Open Login

Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, writes output files for scheduled jobs under its own privileges instead of the entity that launched it, which allows attackers to overwrite system files, aka "Flaw in Output File Handling for Scheduled Jobs."

Affected products Warnungen 0 Metrics 2 CWE 0 References 6

Data is provided by the National Vulnerability Database (NVD)

Microsoft ≫ Data Engine Version1.0

Microsoft ≫ Data Engine Version2000

Microsoft ≫ Sql Server Version7.0

Microsoft ≫ Sql Server Version7.0 Updatesp1

Microsoft ≫ Sql Server Version7.0 Updatesp2

Microsoft ≫ Sql Server Version7.0 Updatesp3

Microsoft ≫ Sql Server Version7.0 Updatesp4

Microsoft ≫ Sql Server Version2000

Microsoft ≫ Sql Server Version2000 Updatesp1

Microsoft ≫ Sql Server Version2000 Updatesp2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	11.4%	0.929

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

http://www.ciac.org/ciac/bulletins/n-003.shtml

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-056

http://www.iss.net/security_center/static/10257.php

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2002-1138

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2002-1138

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2002-1138

EUVD