What’s Vulnerable › Vulnerabilities
CVE-2002-0862
- Severity: medium (CVSS 6.8 v2.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 15.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2002-10-04 · updated 2026-06-16
- Weakness: CWE-295
Description
The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.
Affected products
- Microsoft Internet Explorer 11: all versions
- Microsoft Office: all versions
- Microsoft Outlook Express: all versions
- Microsoft Windows 2000: all versions
- Microsoft Windows 98: all versions
- Microsoft Windows 98Se: all versions
- Microsoft Windows Me: all versions
- Microsoft Windows Nt: 4.0
- Microsoft Windows XP Service Pack 3: all versions
References
- http://marc.info/?l=bugtraq&m=102866120821995&w=2
- http://marc.info/?l=bugtraq&m=102918200405308&w=2
- http://marc.info/?l=bugtraq&m=102976967730450&w=2
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-050
- https://exchange.xforce.ibmcloud.com/vulnerabilities/9776
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1056
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1332
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2671
- http://marc.info/?l=bugtraq&m=102866120821995&w=2
- http://marc.info/?l=bugtraq&m=102918200405308&w=2
- http://marc.info/?l=bugtraq&m=102976967730450&w=2
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-050
Get alerted when CVE-2002-0862 or the next vulnerability affects your stack