CVE-2002-1187

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 15.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2002-12-11 · updated 2026-06-16

Description

Cross-site scripting vulnerability (XSS) in Internet Explorer 5.01 through 6.0 allows remote attackers to read and execute files on the local system via web pages using the <frame> or <iframe> element and javascript, aka "Frames Cross Site Scripting," as demonstrated using the PrivacyPolicy.dlg resource.

Affected products

Microsoft Internet Explorer 11: 5.0, 5.0.1, 5.0.1-sp1, 5.0.1-sp2, 5.5, 5.5-sp1 (+2)

References

http://marc.info/?l=bugtraq&m=103158601431054&w=2
http://www.iss.net/security_center/static/10066.php
http://www.osvdb.org/2998
http://www.securityfocus.com/bid/5672
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-066
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A203
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A225
http://marc.info/?l=bugtraq&m=103158601431054&w=2
http://www.iss.net/security_center/static/10066.php
http://www.osvdb.org/2998
http://www.securityfocus.com/bid/5672
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-066

Get alerted when CVE-2002-1187 or the next vulnerability affects your stack