CVE-2002-1138
Estado: ModificadaAlta (7.5)—
Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, writes output files for scheduled jobs under its own privileges instead of the entity that launched it, which allows attackers to overwrite system files, aka "Flaw in Output File Handling for Scheduled Jobs."
CVSS
- Versión: 2.0
- Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 4.71%
- Percentil entre todas las CVEs puntuadas: 92
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- NVD-CWE-Other
Referencias
- http://www.ciac.org/ciac/bulletins/n-003.shtml
- http://www.iss.net/security_center/static/10257.php
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-056
- http://www.ciac.org/ciac/bulletins/n-003.shtml
- http://www.iss.net/security_center/static/10257.php
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-056
JSON original (NVD)
Mostrar
{
"id": "CVE-2002-1138",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": true,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2002-10-11T04:00:00.000",
"references": [
{
"url": "http://www.ciac.org/ciac/bulletins/n-003.shtml",
"source": "cve@mitre.org"
},
{
"url": "http://www.iss.net/security_center/static/10257.php",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-056",
"source": "cve@mitre.org"
},
{
"url": "http://www.ciac.org/ciac/bulletins/n-003.shtml",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.iss.net/security_center/static/10257.php",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-056",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, writes output files for scheduled jobs under its own privileges instead of the entity that launched it, which allows attackers to overwrite system files, aka \"Flaw in Output File Handling for Scheduled Jobs.\""
},
{
"lang": "es",
"value": "Microsoft SQL Server 7.0 y 2000, incluyendo Microsoft Data Engine (Motor de datos) (MSDE) 1.0, y Microsoft Desktop Engine (MSDE) 2000, escribe los ficheros de salida de tareas planificadas bajo sus propios privilegios, en vez de la entidad que lo lanzó, lo que permite a atacantes sobreescribir ficheros del sistema, también conociada como \"Fallo en Manejo de Fichero de Salida en Tareas Planificadas\""
}
],
"lastModified": "2026-06-16T21:58:47.693",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:data_engine:1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F455C373-A9F7-47F9-828E-DEE2C8CC6545"
},
{
"criteria": "cpe:2.3:a:microsoft:data_engine:2000:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51ABD323-BF3F-4825-8788-8FCD614E83E4"
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A2AB95D7-394E-423B-884C-87A9960682EE"
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:7.0:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4355BA3D-B985-4DC7-AD9D-21B64652CC19"
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:7.0:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D590A237-1587-4FF2-BEEA-F96B1C08F84C"
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:7.0:sp3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B004F338-1C8E-4283-8823-1A16A291FCBD"
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:7.0:sp4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "54EB3111-B93A-4577-9592-0D13FE7FD2C4"
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:2000:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A5D559EE-727C-405C-987C-247973A84D32"
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:2000:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4A74EBC1-FD61-4DD1-AC8A-E4B0F333A980"
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:2000:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4BC2A389-68BF-45B1-833D-96B331844424"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}