CVE-2002-1145: microsoft data_engine
Vulnerability summary
CVE-2002-1145 is a high (CVSS 10.0) vulnerability in microsoft data_engine. EPSS estimates a 8.34% chance of exploitation in the next 30 days, higher than 94.9% of scored vulnerabilities.
Timeline
- 21-10-2002PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
The xp_runwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, Microsoft Data Engine (MSDE) 1.0, and Microsoft Desktop Engine (MSDE) 2000 can be executed by PUBLIC, which allows an attacker to gain privileges by updating a webtask that is owned by the database owner through the msdb.dbo.mswebtasks table, which does not have strong permissions.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
8.34%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 8.34% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Microsoft2 products
- data_engine1.0 | 2000
- sql_server7.0 | 7.0:sp1 | 7.0:sp2 | 7.0:sp3 | 7.0:sp4 | 2000 | 2000:sp1 | 2000:sp2
1 vendor · 2 products
References
7 links- www.nextgenss.com/advisories/mssql-webtasks.txtX Refsource MISC
docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-061Vendor AdvisoryX Refsource MS