CVE-2000-0788 Code injection in n/a

Critical 10.0 Published 9 Mar 2002 Updated 8 Aug 2024

An attacker can execute arbitrary commands by tricking a user into opening a malicious Access database via Word's Mail Merge tool.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2000-0788?

CVE-2000-0788 is a critical code injection vulnerability in Microsoft Word, published on 9 Mar 2002. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

The Mail Merge tool in Microsoft Word does not prompt the user before executing Visual Basic (VBA) scripts in an Access database, which could allow an attacker to execute arbitrary commands.

Which versions are affected by CVE-2000-0788?

It affects 2 products.

Products include Microsoft Access, Microsoft Word.

How do I fix CVE-2000-0788?

No fix has been published for CVE-2000-0788 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2000-0788 being exploited?

There is no known exploitation of CVE-2000-0788 in the wild and no public exploit code.

All Microsoft Word vulnerabilities

Sources

Also known as GHSA-h974-5hr9-px48.