CVE-2002-1143

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 53.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2003-04-11 · updated 2026-06-16

Description

Microsoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when the document is returned to the attacker, as demonstrated in Word using (1) INCLUDETEXT or (2) INCLUDEPICTURE, aka "Flaw in Word Fields and Excel External Updates Could Lead to Information Disclosure."

Affected products

Microsoft Excel 2013 Service Pack 1: 2002, 2002-sp1, 2002-sp2
Microsoft Word for Android: 97, 97-sr1, 97-sr2, 98, 2000, 2000-sp2 (+6)

References

http://marc.info/?l=bugtraq&m=103040003014999&w=2
http://marc.info/?l=bugtraq&m=103252858816401&w=2
http://www.iss.net/security_center/static/10008.php
http://www.iss.net/security_center/static/10155.php
http://www.kb.cert.org/vuls/id/899713
http://www.microsoft.com/technet/treeview/default.asp?url=/Technet/security/topics/secword.asp
http://www.securityfocus.com/bid/5586
http://www.securityfocus.com/bid/5764
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-059
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A202
http://marc.info/?l=bugtraq&m=103040003014999&w=2
http://marc.info/?l=bugtraq&m=103252858816401&w=2

Get alerted when CVE-2002-1143 or the next vulnerability affects your stack