« Volver al listado

CVE-2002-1495

Estado: ModificadaMedia (4.3)—💥 Exploit

Vulnerabilidad de scripts en sitios cruzados (XSS) en JAWmail 1.0-rc1 permite a atacantes remotos insertar script o HTML arbitrario mediante nombres de fichero adjunto en la característica Leer Correo. correos en formato text/html que son mostrados en una ventana emergente ciertos atributos maliciosos en etiquetas normalemente seguras, como onMouseOver

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

Rudi Benkovic — Jawmail

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2002-1495",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2003-04-02T05:00:00.000",
  "references": [
    {
      "url": "http://archives.neohapsis.com/archives/bugtraq/2002-09/0270.html",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.iss.net/security_center/static/10152.php",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/5771",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://archives.neohapsis.com/archives/bugtraq/2002-09/0270.html",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.iss.net/security_center/static/10152.php",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/5771",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in JAWmail 1.0-rc1 allows remote attackers to insert arbitrary script or HTML via (1) attached file names in the Read Mail feature, (2) text/html mails that are displayed in a pop-up window, and (3) certain malicious attributes within otherwise safe tags, such as onMouseOver."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de scripts en sitios cruzados (XSS) en JAWmail 1.0-rc1 permite a atacantes remotos insertar script o HTML arbitrario mediante \r\nnombres de fichero adjunto en la característica Leer Correo.\r\ncorreos en formato text/html que son mostrados en una ventana emergente\r\nciertos atributos maliciosos en etiquetas normalemente seguras, como onMouseOver"
    }
  ],
  "lastModified": "2026-06-16T21:59:26.103",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rudi_benkovic:jawmail:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "53A7F944-3728-41E1-A53B-DBE95F3F40FC"
            },
            {
              "criteria": "cpe:2.3:a:rudi_benkovic:jawmail:1.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B2FD5785-F482-4D24-922D-80B8404F8123"
            },
            {
              "criteria": "cpe:2.3:a:rudi_benkovic:jawmail:1.0_rc1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "32F7E246-FDB7-4A48-B3AC-4B518AB7C52C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}