CVE-2002-0862

medium · 6.8

The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.

6.8

CVSS

15.8%

EPSS (exploit prob.)

97th

EPSS percentile

2002-10-04

Published

AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

CWE-295

Affected products

Vendor	Product	Affected versions
microsoft	windows_2000	all versions
microsoft	windows_98	all versions
microsoft	windows_98se	all versions
microsoft	windows_me	all versions
microsoft	windows_nt	4.0
microsoft	windows_nt	4.0
microsoft	windows_xp	all versions
microsoft	internet_explorer	all versions
microsoft	office	all versions
microsoft	outlook_express	all versions
apple	macos	all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2002-0862