CVE-2004-0420
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP...
CVE-2004-0420 is a high vulnerability (CVSS 10.0) in Microsoft Ie, published April 20, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 46.0%, the 98th percentile. No source names a fixed version.
- Severity
- 10.0 HighCVSS 2.0, NVD
- Exploit chance
- 46.0%EPSS, 98th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.
Exploit likelihood
Affected products
What each source reports
NVD Score used
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.
- Record
CVE-2004-0420- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE ListNo score
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.
- Record
CVE-2004-0420- Updated
- 2026-11-02
EUVDEUVD-2004-0419No score
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.
- Record
EUVD-2004-0419- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-24gh-95jq-75q6No score
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP...
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.
- Record
GHSA-24gh-95jq-75q6- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
exchange.xforce.ibmcloud.com/vulnerabilities/14964
securityfocus.com/bid/9510
us-cert.gov/cas/techalerts/TA04-196A.html
secunia.com/advisories/10736
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2894
Show 10 moreShow less
kb.cert.org/vuls/id/106324
security-express.com/archives/bugtraq/2004-01/0300.html
docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-024
nvd.nist.gov/vuln/detail/CVE-2004-0420
github.com/advisories/GHSA-24gh-95jq-75q6