8.8high
CVE-2003-1378in critical feed1 exploit
Microsoft Outlook Express 6.0 and Outlook 2000, with the security zone set to Internet Zone, allows remote attackers to execute arbitrary p…
Published 22 y ago · modified 4 mo ago · JSON
CVSS
8.8
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
15.6%
percentile 97%
Public exploits
1
Exploit-DB
Summary
Microsoft Outlook Express 6.0 and Outlook 2000, with the security zone set to Internet Zone, allows remote attackers to execute arbitrary programs via an HTML email with the CODEBASE parameter set to the program, a vulnerability similar to CAN-2002-0077.
Exploit prediction (EPSS)
15.58% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.
Exploits and detections
- EDB-22280 Microsoft Outlook2000/Express 6.0 - Arbitrary Program Execution · remote · 2003-02-24
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 8.8 | AV:N/AC:M/Au:N/C:C/I:C/A:N |
Classification
- Weakness
- CWE-264 Permissions, Privileges, and Access Controls
References
- securityfocus.com /archive/1/312910 · mailing-list, x_refsource_BUGTRAQ, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/11411 · vdb-entry, x_refsource_XF, x_transferred
- securityfocus.com /bid/6923 · vdb-entry, x_refsource_BID, x_transferred
- securityfocus.com /archive/1/312929 · mailing-list, x_refsource_BUGTRAQ, x_transferred
Sources
- CVE List: CVE-2003-1378
- NVD: CVE-2003-1378
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.