CVE-2002-0018 in the critical feed json
In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify t…
published 2002-03-08 24 y ago modified 2026-06-16 4 mo ago also EUVD-2002-0018
- cvss
- 10.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 16.4%
- EPSS 16.4% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted domain is authoritative for all listed SIDs, which allows remote attackers to gain Domain Administrator privileges on the trusting domain by injecting SIDs from untrusted domains into the authorization data that comes from from the trusted domain.
Exploit prediction
16.40% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
References
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2002/ms02-001
vendor-advisory
-
securityfocus.com
/bid/3997
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/8023
vdb-entry
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A159
vdb-entry, signature
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A64
vdb-entry, signature
Sources
- CVE List CVE-2002-0018
- NVD CVE-2002-0018
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.