PT-2001-1565 · Microsoft · Internet Explorer+2

Published 2001-07-21 · Updated 2020-04-02 · CVE-2001-0340

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Exchange 2000 Server

Description The issue arises from an interaction between the Outlook Web Access (OWA) service in Microsoft Exchange and Internet Explorer, allowing attackers to execute malicious script code against a user's mailbox. This is achieved through a message attachment containing HTML code that is executed automatically.

Recommendations For Microsoft Exchange 2000 Server, consider disabling the execution of HTML code in message attachments as a temporary workaround until a patch is available. Restrict access to sensitive mailboxes to minimize the risk of exploitation. Avoid using Internet Explorer to access Outlook Web Access until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2001-0340

Affected Products

Internet Explorer

Exchange 2000 Server

Outlook Web Access

References · 5

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-030 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-0340 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6652 · Note
• http://ciac.org/ciac/bulletins/l-091.shtml · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0340 · Note