CVE-2002-0018
In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization...
In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted domain is authoritative for all listed SIDs, which allows remote attackers to gain Domain Administrator privileges on the trusting domain by injecting SIDs from untrusted domains into the authorization data that comes from from the trusted domain.
Exploit likelihood
What each source reports
NVD Score used
In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted domain is authoritative for all listed SIDs, which allows remote attackers to gain Domain Administrator privileges on the trusting domain by injecting SIDs from untrusted domains into the authorization data that comes from from the trusted domain.
- Record
CVE-2002-0018- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted domain is authoritative for all listed SIDs, which allows remote attackers to gain Domain Administrator privileges on the trusting domain by injecting SIDs from untrusted domains into the authorization data that comes from from the trusted domain.
- Record
CVE-2002-0018- Updated
- 2026-11-02
EUVDEUVD-2002-0018 No score
In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted domain is authoritative for all listed SIDs, which allows remote attackers to gain Domain Administrator privileges on the trusting domain by injecting SIDs from untrusted domains into the authorization data that comes from from the trusted domain.
- Record
EUVD-2002-0018- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-84q6-qhjv-vpr6 No score
In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization...
In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted domain is authoritative for all listed SIDs, which allows remote attackers to gain Domain Administrator privileges on the trusting domain by injecting SIDs from untrusted domains into the authorization data that comes from from the trusted domain.
- Record
GHSA-84q6-qhjv-vpr6- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2002-0018 is a high vulnerability (CVSS 10.0) in Microsoft Windows 2000, published March 8, 2002. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 16.4%, the 96th percentile. No source names a fixed version.
References
securityfocus.com/bid/3997
exchange.xforce.ibmcloud.com/vulnerabilities/8023
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A159
docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-001
nvd.nist.gov/vuln/detail/CVE-2002-0018
github.com/advisories/GHSA-84q6-qhjv-vpr6