7.5high
CVE-2001-1088in critical feed1 exploit
Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the "Automatically put people I reply to in my address book" opt…
Published 25 y ago · modified 4 mo ago · JSON
CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
19.7%
percentile 97%
Public exploits
1
Exploit-DB
Summary
Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the "Automatically put people I reply to in my address book" option enabled, do not notify the user when the "Reply-To" address is different than the "From" address, which could allow an untrusted remote attacker to spoof legitimate addresses and intercept email from the client that is intended for another user.
Exploit prediction (EPSS)
19.71% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.
Exploits and detections
- EDB-20899 Microsoft Outlook 97/98/2000/4/5 - Address Book Spoofing · remote · 2001-06-05
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
- securityfocus.com /archive/1/188752 · mailing-list, x_refsource_BUGTRAQ, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/6655 · vdb-entry, x_refsource_XF, x_transferred
- securityfocus.com /bid/2823 · vdb-entry, x_refsource_BID, x_transferred
- support.microsoft.com /default.aspx?scid=kb%3BEN-US%3Bq234241 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2001-1088
- NVD: CVE-2001-1088
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.