{"api_version":"1","generated_at":"2026-07-23T22:42:48+00:00","cve":"CVE-2002-0622","urls":{"html":"https://cve.report/CVE-2002-0622","api":"https://cve.report/api/cve/CVE-2002-0622.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2002-0622","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2002-0622"},"summary":{"title":"CVE-2002-0622","description":"The Office Web Components (OWC) package installer for Microsoft Commerce Server 2000 allows remote attackers to execute commands by passing the commands as input to the OWC package installer, aka \"OWC Package Command Execution\".","state":"PUBLISHED","assigner":"mitre","published_at":"2002-07-03 04:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-033","name":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-033","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Microsoft Security Bulletin MS02-033 - Critical | Microsoft Docs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/5170","name":"http://www.osvdb.org/5170","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.iss.net/security_center/static/9425.php","name":"http://www.iss.net/security_center/static/9425.php","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"ISS X-Force Database: mscs-owc-installer-permissions (9425): Microsoft Commerce Server OWC package installer folder permissions could allow remote command execution","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/5111","name":"http://www.securityfocus.com/bid/5111","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Microsoft Commerce Server 2000 OWC Package Installer Local Command Execution Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2002-0622","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2002-0622","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2002","cve_id":"622","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"commerce_server","cpe6":"2000","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"622","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"commerce_server","cpe6":"2000","cpe7":"sp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"622","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"commerce_server","cpe6":"2000","cpe7":"sp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-08T02:56:38.307Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"MS02-033","tags":["vendor-advisory","x_refsource_MS","x_transferred"],"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-033"},{"name":"5111","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/5111"},{"name":"5170","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/5170"},{"name":"mscs-owc-installer-permissions(9425)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"http://www.iss.net/security_center/static/9425.php"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2002-06-26T00:00:00.000Z","descriptions":[{"lang":"en","value":"The Office Web Components (OWC) package installer for Microsoft Commerce Server 2000 allows remote attackers to execute commands by passing the commands as input to the OWC package installer, aka \"OWC Package Command Execution\"."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2003-03-21T00:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"MS02-033","tags":["vendor-advisory","x_refsource_MS"],"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-033"},{"name":"5111","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/5111"},{"name":"5170","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/5170"},{"name":"mscs-owc-installer-permissions(9425)","tags":["vdb-entry","x_refsource_XF"],"url":"http://www.iss.net/security_center/static/9425.php"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2002-0622","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Office Web Components (OWC) package installer for Microsoft Commerce Server 2000 allows remote attackers to execute commands by passing the commands as input to the OWC package installer, aka \"OWC Package Command Execution\"."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"MS02-033","refsource":"MS","url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-033"},{"name":"5111","refsource":"BID","url":"http://www.securityfocus.com/bid/5111"},{"name":"5170","refsource":"OSVDB","url":"http://www.osvdb.org/5170"},{"name":"mscs-owc-installer-permissions(9425)","refsource":"XF","url":"http://www.iss.net/security_center/static/9425.php"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2002-0622","datePublished":"2003-04-02T05:00:00.000Z","dateReserved":"2002-06-12T00:00:00.000Z","dateUpdated":"2024-08-08T02:56:38.307Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2002-07-03 04:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":true,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:commerce_server:2000:*:*:*:*:*:*:*","matchCriteriaId":"AF65806C-05BF-4EB7-976B-3346F2D64886"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:commerce_server:2000:sp1:*:*:*:*:*:*","matchCriteriaId":"C73B40C1-B8D7-46FB-B327-8C93F2ACDD9D"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:commerce_server:2000:sp2:*:*:*:*:*:*","matchCriteriaId":"DD28CDF4-00E9-4F61-8201-76FB44544A33"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2002","CveId":"622","Ordinal":"1","Title":"CVE-2002-0622","CVE":"CVE-2002-0622","Year":"2002"},"notes":[{"CveYear":"2002","CveId":"622","Ordinal":"1","NoteData":"The Office Web Components (OWC) package installer for Microsoft Commerce Server 2000 allows remote attackers to execute commands by passing the commands as input to the OWC package installer, aka \"OWC Package Command Execution\".","Type":"Description","Title":"CVE-2002-0622"},{"CveYear":"2002","CveId":"622","Ordinal":"2","NoteData":"2003-04-02","Type":"Other","Title":"Published"},{"CveYear":"2002","CveId":"622","Ordinal":"3","NoteData":"2003-03-20","Type":"Other","Title":"Modified"}]}}}