CVE-2001-0137

Windows Media Player 7 allows remote attackers to execute malicious Java applets in Internet Explorer clients by enclosing the applet in a…

Medium5.1EPSS 22.2%

Published: 7 May 2001
Updated: 8 Aug 2024
Reserved: 6 Feb 2001
Assigned by: mitre

Description

Windows Media Player 7 allows remote attackers to execute malicious Java applets in Internet Explorer clients by enclosing the applet in a skin file named skin.wmz, then referencing that skin in the codebase parameter to an applet tag, aka the Windows Media Player Skins File Download" vulnerability.

Timeline

2001
6 Feb 2001
6 Feb 2001
ID reserved
By mitre
7 May 20013 months later
7 May 2001· 3 months later
Published
2024
8 Aug 202423 years later
8 Aug 2024· 23 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2001-0137, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	2.0	Medium5.1	AV:N/AC:H/Au:N/C:P/I:P/A:P

EPSS (exploitation in 30 days): 22.2% · top 2.3% of all CVEs (8 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.1.

Weakness

Affected products

n/a
- affected n/a

References (4)

2203 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
MS01-010 (opens in a new tab)vendor-advisoryx_refsource_MSx_transferred
20010115 Windows Media Player 7 and IE java vulnerability - executing arbitrary programs (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
win-mediaplayer-arbitrary-code(5937) (opens in a new tab)vdb-entryx_refsource_XFx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2001-0137](https://cveledger.app/badge/CVE-2001-0137.svg)](https://cveledger.app/cve/CVE-2001-0137)

Record last updated 8 Aug 2024, 04:06 UTC.