TI-2002-01265 Aliases CVE-2002-1339 GHSA-3vxf-84gf-58q9

The "XMLURL" property in the Spreadsheet component of Office Web Components (OWC) 10…

LOW 37Published 2002-12-11 · Updated 2024-08-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Partial · None · None
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The "XMLURL" property in the Spreadsheet component of Office Web Components (OWC) 10 follows redirections, which allows remote attackers to determine the existence of local files based on exceptions, or to read WorkSheet XML files.

Why it matters now

EPSS 0.11968 96th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:office_web_components:2002:::::::*	2002	Vulnerable	Microsoft

cpe:2.3:a:microsoft:office_web_components:2002:*:*:*:*:*:*:* Versions 2002 Vulnerable ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2002-1339
2026-10-03 Alias added: GHSA-3vxf-84gf-58q9

References

Exploit 1

http://security.greymagic.com/adv/gm008-ie/

Other 1

20020408 Multiple local files detection issues with OWC in IE (GM#008-IE)

TI-2012-01640 The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office… KEVCVSS 3.1HIGH 8.8
TI-2012-00154 The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in… KEVCVSS 3.1HIGH 8.8
TI-2009-01078 The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as… CVSS 2.0HIGH 9.3
TI-2009-01455 Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3… CVSS 2.0HIGH 9.3
TI-2006-04540 Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000… CVSS 2.0HIGH 9.3
TI-2009-02384 Heap-based buffer overflow in the Office Web Components ActiveX Control in Microsoft… CVSS 2.0HIGH 9.3

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences