« Back to list

CVE-2000-0160

Status: ModifiedHigh (7.6)—

The Microsoft Active Setup ActiveX component in Internet Explorer 4.x and 5.x allows a remote attacker to install software components without prompting the user by stating that the software's manufacturer is Microsoft.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (3)

Microsoft — IEMicrosoft — Internet ExplorerMicrosoft — Outlook

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2000-0160",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "HIGH",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 4.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2000-02-21T05:00:00.000",
  "references": [
    {
      "url": "http://www.securityfocus.com/templates/archive.pike?list=1&date=2000-02-15&msg=20000221103938.T21312%40securityfocus.com",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/templates/archive.pike?list=1&date=2000-02-15&msg=20000221103938.T21312%40securityfocus.com",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Microsoft Active Setup ActiveX component in Internet Explorer 4.x and 5.x allows a remote attacker to install software components without prompting the user by stating that the software's manufacturer is Microsoft."
    }
  ],
  "lastModified": "2026-06-16T21:51:07.510",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:ie:4.x:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45091F51-BA28-4FEB-9F84-58AC2E1DB48F"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:internet_explorer:5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4071D03-D955-4C1B-ACD8-A864F7D0FA02"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:outlook:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91EB05F7-D88A-40AA-A8CB-F76C449878AA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}