CVE-2002-1325: Microsoft Windows 2000

Medium severity, CVSS 5.0. EPSS: 13.9% chance of exploitation in the next 30 days.

Microsoft Virtual Machine (VM) build 5.0.3805 and earlier allows remote attackers to determine a local user's username via a Java applet that accesses the user.dir system property, aka "User.dir Exposure Vulnerability."

Affected products

• Microsoft Windows 2000: any version
• Microsoft Windows 2000 Terminal Services: any version
• Microsoft Windows 95: any version
• Microsoft Windows 98: any version
• Microsoft Windows 98se: any version
• Microsoft Windows Me: any version
• Microsoft Windows Nt: version 4.0 only
• Microsoft Windows XP: any version

Published 2002-12-23. Last modified 2026-06-16.