Vulnerability record · CVE-2002-1254 · published 11 December 2002
CVE-2002-1254: Internet Explorer cross-domain bypass via cached methods and objects
Microsoft · Ie
Internet Explorer 5.5 and 6.0 fails to properly enforce the cross-domain security model when cached methods and objects are used, allowing a remote attacker to bypass domain boundaries. This lets a malicious page read information from the local system or other domains, and possibly execute code.
Description
Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model and access information on the local system or in other domains, and possibly execute code, via cached methods and objects, aka "Cross Domain Verification via Cached Methods."
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityCVSS 2.0 base score is 7.5 (HIGH) with a network vector and no authentication, and public exploit code is referenced, though the affected software is obsolete.
What it is
Internet Explorer 5.5 and 6.0 fails to properly enforce the cross-domain security model when cached methods and objects are used, allowing a remote attacker to bypass domain boundaries. This lets a malicious page read information from the local system or other domains, and possibly execute code.
Impact
An attacker can access data belonging to other domains or the local system and may achieve code execution in the context of the victim's browser.
Attack surface
Reached over the network via a crafted web page or content rendered in Internet Explorer; no authentication is required, but the victim must load the malicious content (user interaction).
Exploitation
Not listed in CISA KEV, but EPSS is high (0.5351, 98.94th percentile) and a SecurityFocus reference is tagged Exploit, indicating public exploit code exists.
What to do
- Apply the Microsoft security update referenced in MS02-066.
- Upgrade to a supported, modern browser; IE 5.5/6.0 are long out of support.
- Restrict or disable legacy Internet Explorer usage in the environment.
- Enforce network controls that block untrusted web content from reaching legacy IE clients.
Detection
- Monitor for legacy IE user agents (MSIE 5.5/6.0) in web proxy and server logs.
- Hunt for known exploit signatures or anomalous cross-domain script activity tied to IE.
- Review endpoint telemetry for IE processes spawning unexpected child processes.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2002-1254 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2002-1254), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
