$ cve CVE-2002-0862 JSON

CVE-2002-0862 EXPLOIT

6.8

MEDIUM · CVSS 2.0 · EPSS 15.8% (pctl 97)

Patch early

A public exploit exists.

Description

The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.

Scoring

CVSS	6.8 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS	15.76% — more likely to be exploited than 97% of all CVEs
Weakness	CWE-295
On CISA KEV	no
Public exploit	yes
Published	2002-10-04
Last modified	2026-06-16

Affected (10)

Vendor	Product
apple	macos
microsoft	internet explorer
microsoft	office
microsoft	outlook express
microsoft	windows 2000
microsoft	windows 98
microsoft	windows 98se
microsoft	windows me
microsoft	windows nt
microsoft	windows xp

Public exploits

Source	Title	Date
exploit-db	Microsoft Internet Explorer 5/6 / Konqueror 2.2.2/3.0 / Weblogic Server 5/6/7 - Invalid X.509 Certificate Chain	2002-08-06

References

→ the Explorer · watch your stack · NVD