CVE-2002-0411

Estado: ModificadaAlta (7.5)—

Cross-site scripting vulnerability in message.php for AeroMail before 1.45 allows remote attackers to execute Javascript as an AeroMail user via an email message with the script in the Subject line.

CVSS

Versión: 2.0
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 2.76%
Percentil entre todas las CVEs puntuadas: 86
Fecha de la puntuación: 7/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Aeromail — Aeromail

CWE

NVD-CWE-Other

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2002-0411",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": true,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2002-08-12T04:00:00.000",
  "references": [
    {
      "url": "http://archives.neohapsis.com/archives/bugtraq/2002-03/0004.html",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://the.cushman.net/projects/aeromail/download/aeromail-1.45.tar.gz",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.iss.net/security_center/static/8346.php",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/4215",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://archives.neohapsis.com/archives/bugtraq/2002-03/0004.html",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://the.cushman.net/projects/aeromail/download/aeromail-1.45.tar.gz",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.iss.net/security_center/static/8346.php",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/4215",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting vulnerability in message.php for AeroMail before 1.45 allows remote attackers to execute Javascript as an AeroMail user via an email message with the script in the Subject line."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados en message.php para AeroMail anteriores a la 1.45 permiten a atacantes remotos la ejecución de Javascript como un usuario AeroMail mediante un mensaje de correo electrónico con la rutina a ejecutar escrita en la linea de \"Asunto\" del mensaje."
    }
  ],
  "lastModified": "2026-06-16T21:57:23.637",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:aeromail:aeromail:1.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BBDE2D7-7CFA-416C-89A7-AC30153C8DDC"
            },
            {
              "criteria": "cpe:2.3:a:aeromail:aeromail:1.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82999523-8FF9-429C-BAA6-93BED85F389F"
            },
            {
              "criteria": "cpe:2.3:a:aeromail:aeromail:1.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CDEFFA62-D764-4CEF-9614-47779368EB5D"
            },
            {
              "criteria": "cpe:2.3:a:aeromail:aeromail:1.26:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9180985E-1296-4CC1-A9DF-0DE8249C0300"
            },
            {
              "criteria": "cpe:2.3:a:aeromail:aeromail:1.30:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "87A5B8D1-FD94-4E8C-9D6D-85BDDD28ABD3"
            },
            {
              "criteria": "cpe:2.3:a:aeromail:aeromail:1.40:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "425D6C42-1B74-4D01-9578-83FD4E71B5F0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}