CVE-2002-0057

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 23.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2002-03-08 · updated 2026-06-16

Description

XMLHTTP control in Microsoft XML Core Services 2.6 and later does not properly handle IE Security Zone settings, which allows remote attackers to read arbitrary files by specifying a local file as an XML Data Source.

Affected products

Microsoft Internet Explorer 11: 6.0
Microsoft SQL Server: 2000, 2000-sp1, 2000-sp2
Microsoft Windows XP Service Pack 3: all versions
Microsoft Corporation XML Core Services: 2.6, 3.0, 4.0

References

http://archives.neohapsis.com/archives/bugtraq/2001-12/0152.html
http://marc.info/?l=bugtraq&m=101366383408821&w=2
http://www.osvdb.org/3032
http://www.securityfocus.com/bid/3699
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-008
https://exchange.xforce.ibmcloud.com/vulnerabilities/7712
http://archives.neohapsis.com/archives/bugtraq/2001-12/0152.html
http://marc.info/?l=bugtraq&m=101366383408821&w=2
http://www.osvdb.org/3032
http://www.securityfocus.com/bid/3699
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-008
https://exchange.xforce.ibmcloud.com/vulnerabilities/7712

Get alerted when CVE-2002-0057 or the next vulnerability affects your stack