CVE-2002-0187: High severity Microsoft SQL Server vulnerability

Published Jul 3, 2002

Updated

Cross-site scripting vulnerability in the SQLXML component of Microsoft SQL Server 2000 allows an attacker to execute arbitrary script via the root parameter as part of an XML SQL query, aka "Script Injection via XML Tag."

Affected Software

3 affected components

Microsoft SQL Server=2000-sp2

Microsoft SQL Server=2000

Microsoft SQL Server=2000-sp1

Remediation

Patch Available

http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0100.html

Event History

Jul 3, 2002

CVE Published

04:00 AM

Apr 2, 2003

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2002-0187?

CVE-2002-0187 is considered a moderate severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2002-0187?

To fix CVE-2002-0187, apply the latest service pack and security updates for Microsoft SQL Server 2000.

What versions of SQL Server are affected by CVE-2002-0187?

CVE-2002-0187 affects Microsoft SQL Server 2000, specifically versions 2000, 2000 SP1, and 2000 SP2.

What kind of attack does CVE-2002-0187 allow?

CVE-2002-0187 allows attackers to execute arbitrary scripts via cross-site scripting through XML SQL queries.

Is CVE-2002-0187 easily exploitable?

Yes, CVE-2002-0187 can be easily exploited if the application does not properly sanitize input parameters.