CVE-2002-0027 in the critical feed json
Internet Explorer 5.5 and 6.0 allows remote attackers to read certain files and spoof the URL in the address bar by using the Document.open…
published 2002-03-08 24 y ago modified 2026-06-16 4 mo ago also EUVD-2002-0027
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 19.3%
- EPSS 19.3% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
Internet Explorer 5.5 and 6.0 allows remote attackers to read certain files and spoof the URL in the address bar by using the Document.open function to pass information between two frames from different domains, a new variant of the "Frame Domain Verification" vulnerability described in MS:MS01-058/CAN-2001-0874.
Patch / fix
- securityfocus.com/bid/3721 advisory
Exploit prediction
19.32% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- securityfocus.com http://www.securityfocus.com/bid/3721 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
securityfocus.com
/bid/3721
vdb-entry, exploit, patch, vendor-advisory
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2002/ms02-005
vendor-advisory
-
securityfocus.com
/archive/1/246522
mailing-list, vendor-advisory
-
osvdb.org
/3031
vdb-entry
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A974
vdb-entry, signature
Sources
- CVE List CVE-2002-0027
- NVD CVE-2002-0027
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.