CVE-2002-2125

Internet Explorer 6.0 does not warn users when an expired certificate authority (CA) certificate is submitted to the user and a newer CA certificate is in the user's local repository, which could allow remote attackers to decrypt web sessions via a man-in-the-middle (MITM) attack.

Published: Dec 31, 2002
Updated: Apr 13, 2023
CVE: CVE-2002-2125
Severity: Medium
Exploit:

CVSS v2:

Severity: Medium
Score: 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:N

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
microsoft / ie	6.0-sp1	6.0-sp1.x
microsoft / internet_explorer	6.0.2600	6.0.2600.x
microsoft / internet_explorer	6.0.2800.1106	6.0.2800.1106.x

http://www.iss.net/security_center/static/10180.php
http://www.securityfocus.com/archive/1/292842
http://www.securityfocus.com/bid/5778

Vulnerability Database

289,871

CVE-2002-2125