vulnwire
10.0crit

CVE-2002-1145in critical feed

The xp_runwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, Microsoft Data Engine (MSDE) 1.0, and M…

Published 24 y ago · modified 4 mo ago · JSON

CVSS
10.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
8.3%
percentile 95%
Public exploits
0
none known

The xp_runwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, Microsoft Data Engine (MSDE) 1.0, and Microsoft Desktop Engine (MSDE) 2000 can be executed by PUBLIC, which allows an attacker to gain privileges by updating a webtask that is owned by the database owner through the msdb.dbo.mswebtasks table, which does not have strong permissions.

Exploit prediction (EPSS)

8.34% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Technology feeds
Microsoft SQL Server (RSS, critical only)

References

  • securityfocus.com /bid/5980 · vdb-entry, x_refsource_BID, x_transferred
  • nextgenss.com /advisories/mssql-webtasks.txt · x_refsource_MISC, x_transferred
  • iss.net /security_center/static/10388.php · vdb-entry, x_refsource_XF, x_transferred
  • marc.info /?l=bugtraq&m=103487044122900&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • docs.microsoft.com /en-us/security-updates/securitybulletins/2002/ms02-061 · vendor-advisory, x_refsource_MS, x_transferred
  • marc.info /?l=ntbugtraq&m=103486356413404&w=2 · mailing-list, x_refsource_NTBUGTRAQ, x_transferred
  • cisco.com /warp/public/707/cisco-sa-20030126-ms02-061.shtml · vendor-advisory, x_refsource_CISCO, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.