vulnwire
7.5high

CVE-2002-0054in critical feed

SMTP service in (1) Microsoft Windows 2000 and (2) Internet Mail Connector (IMC) in Exchange Server 5.5 does not properly handle responses…

Published 24 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
22.4%
percentile 98%
Public exploits
0
none known

SMTP service in (1) Microsoft Windows 2000 and (2) Internet Mail Connector (IMC) in Exchange Server 5.5 does not properly handle responses to NTLM authentication, which allows remote attackers to perform mail relaying via an SMTP AUTH command using null session credentials.

Exploit prediction (EPSS)

22.44% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-294 Authentication Bypass by Capture-replay
Technology feeds
Microsoft Exchange (RSS, critical only)

References

  • marc.info /?l=bugtraq&m=101501580409373&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • docs.microsoft.com /en-us/security-updates/securitybulletins/2002/ms02-011 · vendor-advisory, x_refsource_MS, x_transferred
  • securityfocus.com /bid/4205 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.