CVE-2000-0160 describes a critical vulnerability in Microsoft Active Setup ActiveX component affecting Internet Explorer versions 4.x and 5.x, and potentially Microsoft Outlook. This flaw allows a remote attacker to silently install software by falsely claiming Microsoft as the manufacturer, bypassing user prompts. With a CVSS score of 7.6 (HIGH), it presents a significant risk due to its network-based attack vector and complete compromise of confidentiality, integrity, and availability. While no public exploit code or active exploitation is indicated, and community discussion is minimal, the potential for silent software installation makes it a serious concern for unpatched systems.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
4.xCPE matchmatch criteria | cpe:2.3:a:microsoft:ie:4.x:*:*:*:*:*:*:* | ||
5CPE matchmatch criteria | cpe:2.3:a:microsoft:internet_explorer:5:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:a:microsoft:outlook:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:H/Au:N/C:C/I:C/A:C
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.