CVE-2002-1143 Information disclosure in n/a

What is CVE-2002-1143?

CVE-2002-1143 is a medium-severity vulnerability in Microsoft Excel, published on 3 Apr 2003. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Microsoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when the document is returned to the attacker, as demonstrated in Word using (1) INCLUDETEXT or (2) INCLUDEPICTURE, aka "Flaw in Word Fields and Excel External Updates Could Lead to Information Disclosure."

Which versions are affected by CVE-2002-1143?

It affects 2 products.

Products include Microsoft Excel, Microsoft Word.

How do I fix CVE-2002-1143?

No fix has been published for CVE-2002-1143 yet. Limit exposure of the affected software until one is available.

Is CVE-2002-1143 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2002-1143 exists.

Public exploit code: 2 Exploit-DB entries.

Other vulnerabilities in Microsoft Excel

• CVE-2019-1297 Microsoft Excel Remote Code Execution Exploited High 8.8
• CVE-2009-0238 Microsoft Office Remote Code Execution Exploited High 8.8
• CVE-2016-7262 Microsoft Office Security Feature Bypass Exploited High 7.8
• CVE-2009-3129 Microsoft Excel Featheader Record Memory Corruption Exploited High 7.8
• CVE-2008-0081 Code injection in n/a Critical 9.8

All Microsoft Excel vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5jm3-4wj9-623c.