CVE-2002-1145 in the critical feed json
The xp_runwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, Microsoft Data Engine (MSDE) 1.0, and M…
published 2002-10-21 24 y ago modified 2026-06-16 4 mo ago also EUVD-2002-1133
- cvss
- 10.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 8.3%
- EPSS 8.3% chance of exploitation in 30 days, percentile 94%
- public exploits
- 0
- none known
Summary
The xp_runwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, Microsoft Data Engine (MSDE) 1.0, and Microsoft Desktop Engine (MSDE) 2000 can be executed by PUBLIC, which allows an attacker to gain privileges by updating a webtask that is owned by the database owner through the msdb.dbo.mswebtasks table, which does not have strong permissions.
Exploit prediction
8.34% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Technology feeds
References
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2002/ms02-061
vendor-advisory
-
cisco.com
/warp/public/707/cisco-sa-20030126-ms02-061.shtml
vendor-advisory
-
iss.net
/security_center/static/10388.php
vdb-entry, vendor-advisory
-
securityfocus.com
/bid/5980
vdb-entry
- nextgenss.com /advisories/mssql-webtasks.txt
-
marc.info
/?l=bugtraq&m=103487044122900&w=2
mailing-list
-
marc.info
/?l=ntbugtraq&m=103486356413404&w=2
mailing-list
Sources
- CVE List CVE-2002-1145
- NVD CVE-2002-1145
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.