{"api_version":"1","generated_at":"2026-07-23T05:13:20+00:00","cve":"CVE-2002-0736","urls":{"html":"https://cve.report/CVE-2002-0736","api":"https://cve.report/api/cve/CVE-2002-0736.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2002-0736","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2002-0736"},"summary":{"title":"CVE-2002-0736","description":"Microsoft BackOffice 4.0 and 4.5, when configured to be accessible by other systems, allows remote attackers to bypass authentication and access the administrative ASP pages via an HTTP request with an authorization type (auth_type) that is not blank.","state":"PUBLISHED","assigner":"mitre","published_at":"2002-08-12 04:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"10","severity":"","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://archives.neohapsis.com/archives/bugtraq/2002-04/0208.html","name":"http://archives.neohapsis.com/archives/bugtraq/2002-04/0208.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Neohapsis Archives - Bugtraq - Back Office Web Administrator Authentication Bypass (#NISR17042002A) - From nisr@ngssoftware.com","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://support.microsoft.com/support/kb/articles/q316/8/38.asp","name":"http://support.microsoft.com/support/kb/articles/q316/8/38.asp","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Javascript is disabled","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/4528","name":"http://www.securityfocus.com/bid/4528","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Microsoft BackOffice Server Web Administration Authentication Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.iss.net/security_center/static/8862.php","name":"http://www.iss.net/security_center/static/8862.php","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"ISS X-Force Database: backoffice-bypass-authentication (8862): Microsoft BackOffice Server allows attacker to bypass authentication for Web administration pages","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2002-0736","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2002-0736","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2002","cve_id":"736","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"backoffice","cpe6":"4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"736","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"backoffice","cpe6":"4.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-08T02:56:38.899Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20020416 Back Office Web Administrator Authentication Bypass (#NISR17042002A)","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://archives.neohapsis.com/archives/bugtraq/2002-04/0208.html"},{"name":"backoffice-bypass-authentication(8862)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"http://www.iss.net/security_center/static/8862.php"},{"name":"Q316838","tags":["vendor-advisory","x_refsource_MSKB","x_transferred"],"url":"http://support.microsoft.com/support/kb/articles/q316/8/38.asp"},{"name":"4528","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/4528"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2002-04-17T00:00:00.000Z","descriptions":[{"lang":"en","value":"Microsoft BackOffice 4.0 and 4.5, when configured to be accessible by other systems, allows remote attackers to bypass authentication and access the administrative ASP pages via an HTTP request with an authorization type (auth_type) that is not blank."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2002-07-31T09:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"20020416 Back Office Web Administrator Authentication Bypass (#NISR17042002A)","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://archives.neohapsis.com/archives/bugtraq/2002-04/0208.html"},{"name":"backoffice-bypass-authentication(8862)","tags":["vdb-entry","x_refsource_XF"],"url":"http://www.iss.net/security_center/static/8862.php"},{"name":"Q316838","tags":["vendor-advisory","x_refsource_MSKB"],"url":"http://support.microsoft.com/support/kb/articles/q316/8/38.asp"},{"name":"4528","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/4528"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2002-0736","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Microsoft BackOffice 4.0 and 4.5, when configured to be accessible by other systems, allows remote attackers to bypass authentication and access the administrative ASP pages via an HTTP request with an authorization type (auth_type) that is not blank."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20020416 Back Office Web Administrator Authentication Bypass (#NISR17042002A)","refsource":"BUGTRAQ","url":"http://archives.neohapsis.com/archives/bugtraq/2002-04/0208.html"},{"name":"backoffice-bypass-authentication(8862)","refsource":"XF","url":"http://www.iss.net/security_center/static/8862.php"},{"name":"Q316838","refsource":"MSKB","url":"http://support.microsoft.com/support/kb/articles/q316/8/38.asp"},{"name":"4528","refsource":"BID","url":"http://www.securityfocus.com/bid/4528"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2002-0736","datePublished":"2003-04-02T05:00:00.000Z","dateReserved":"2002-07-25T00:00:00.000Z","dateUpdated":"2024-08-08T02:56:38.899Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2002-08-12 04:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:backoffice:4.0:*:*:*:*:*:*:*","matchCriteriaId":"60EAD9D1-B3E1-4DE3-9FCE-CBC2BC025561"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:backoffice:4.5:*:*:*:*:*:*:*","matchCriteriaId":"E6B7299F-C779-4E04-AA33-F91467A9EC37"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2002","CveId":"736","Ordinal":"1","Title":"CVE-2002-0736","CVE":"CVE-2002-0736","Year":"2002"},"notes":[{"CveYear":"2002","CveId":"736","Ordinal":"1","NoteData":"Microsoft BackOffice 4.0 and 4.5, when configured to be accessible by other systems, allows remote attackers to bypass authentication and access the administrative ASP pages via an HTTP request with an authorization type (auth_type) that is not blank.","Type":"Description","Title":"CVE-2002-0736"},{"CveYear":"2002","CveId":"736","Ordinal":"2","NoteData":"2003-04-02","Type":"Other","Title":"Published"},{"CveYear":"2002","CveId":"736","Ordinal":"3","NoteData":"2002-07-31","Type":"Other","Title":"Modified"}]}}}