CVE-2002-1824: Microsoft Ie

Medium severity, CVSS 5.0. EPSS: 2.6% chance of exploitation in the next 30 days.

Microsoft Internet Explorer 6.0, when handling an expired CA-CERT in a webserver's certificate chain during a SSL/TLS handshake, does not prompt the user before searching for and finding a newer certificate, which may allow attackers to perform a man-in-the-middle attack. NOTE: it is not clear whether this poses a vulnerability.

Affected products

• Microsoft Ie: version 6.0 only
• Microsoft Internet Explorer: version 6.0 only

Published 2002-12-31. Last modified 2026-06-16.