PT-2001-1565 · Microsoft · Internet Explorer+2

Publicado 2001-07-21 · Atualizado 2020-04-02 · CVE-2001-0340

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Exchange 2000 Server

Description The issue arises from an interaction between the Outlook Web Access (OWA) service in Microsoft Exchange and Internet Explorer, allowing attackers to execute malicious script code against a user's mailbox. This is achieved through a message attachment containing HTML code that is executed automatically.

Recommendations For Microsoft Exchange 2000 Server, consider disabling the execution of HTML code in message attachments as a temporary workaround until a patch is available. Restrict access to sensitive mailboxes to minimize the risk of exploitation. Avoid using Internet Explorer to access Outlook Web Access until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2001-0340

Produtos afetados

Internet Explorer

Exchange 2000 Server

Outlook Web Access

Referências · 5

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-030 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6652 · Nota
• http://ciac.org/ciac/bulletins/l-091.shtml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-0340 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0340 · Nota