File Existence Disclosure in Office Web Components by Microsoft

CVE-2002-1338

Summary

The Load method in the Chart component of the Office Web Components (OWC) 9 and 10 is vulnerable to a issue where it generates an exception if a specified file does not exist. This behavior can be exploited by remote attackers, enabling them to ascertain the existence of local files on the user's system. By using this vulnerability, attackers can gather sensitive information that could lead to further attacks. It is crucial for users and administrators to apply appropriate mitigations to protect against this type of exposure.

References