What’s Vulnerable › Vulnerabilities
CVE-2002-1186
- Severity: medium (CVSS 5.0 v2.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 19.1% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2002-12-11 · updated 2026-06-16
Description
Internet Explorer 5.01 through 6.0 does not properly perform security checks on certain encoded characters within a URL, which allows a remote attacker to steal potentially sensitive information from a user by redirecting the user to another site that has that information, aka "Encoded Characters Information Disclosure."
Affected products
- Microsoft Ie: 6.0-sp1
- Microsoft Internet Explorer 11: 5.0.1, 5.0.1-sp1, 5.0.1-sp2, 5.5, 5.5-sp1, 5.5-sp2 (+1)
References
- http://archives.neohapsis.com/archives/bugtraq/2002-09/0018.html
- http://archives.neohapsis.com/archives/bugtraq/2002-09/0030.html
- http://www.iss.net/security_center/static/10039.php
- http://www.osvdb.org/7845
- http://www.securityfocus.com/bid/5610
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-066
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A143
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A471
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A495
- http://archives.neohapsis.com/archives/bugtraq/2002-09/0018.html
- http://archives.neohapsis.com/archives/bugtraq/2002-09/0030.html
- http://www.iss.net/security_center/static/10039.php
Get alerted when CVE-2002-1186 or the next vulnerability affects your stack