vulnwire
5.0med

CVE-2002-1139

The Compressed Folders feature in Microsoft Windows 98 with Plus!

Published 24 y ago · modified 4 mo ago · JSON

CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.2%
percentile 91%
Public exploits
0
none known

The Compressed Folders feature in Microsoft Windows 98 with Plus! Pack, Windows Me, and Windows XP does not properly check the destination folder during the decompression of ZIP files, which allows attackers to place an executable file in a known location on a user's system, aka "Incorrect Target Path for Zipped File Decompression."

Exploit prediction (EPSS)

4.23% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:P/A:N

References

  • docs.microsoft.com /en-us/security-updates/securitybulletins/2002/ms02-054 · vendor-advisory, x_refsource_MS, x_transferred
  • securityfocus.com /bid/5876 · vdb-entry, x_refsource_BID, x_transferred
  • iss.net /security_center/static/10252.php · vdb-entry, x_refsource_XF, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.