| Vulnerability Name: | CVE-2004-0121 (CCN-15414) | ||||||||
| Assigned: | 2004-03-09 | ||||||||
| Published: | 2004-03-09 | ||||||||
| Updated: | 2018-10-12 | ||||||||
| Summary: | Argument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE, which allows remote attackers to use script code in the Local Machine zone and execute arbitrary programs. | ||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: CCN Type: BugTraq Mailing List, Wed Mar 10 2004 - 06:35:05 CST Outlook mailto: URL argument injection vulnerability Source: MITRE Type: CNA CVE-2004-0121 Source: BUGTRAQ Type: UNKNOWN 20040310 Outlook mailto: URL argument injection vulnerability Source: CCN Type: CIAC Information Bulletin O-096 Microsoft Outlook Could Allow Unauthorized Code Execution Source: CIAC Type: UNKNOWN O-096 Source: IDEFENSE Type: Patch, Vendor Advisory 20040309 Microsoft Outlook "mailto:" Parameter Passing Vulnerability Source: CCN Type: iDEFENSE Security Advisory 03.09.04: Microsoft Outlook "mailto:" Parameter Passing Vulnerability Source: CCN Type: US-CERT VU#305206 Microsoft Outlook fails to properly filter parameters passed via mailto: URL Source: CERT-VN Type: US Government Resource VU#305206 Source: CCN Type: Microsoft Security Bulletin MS04-009 Vulnerability in Microsoft Outlook Could Allow Code Execution (828040) Source: BID Type: Exploit, Patch, Vendor Advisory 9827 Source: CCN Type: BID-9827 Microsoft Outlook Mailto Parameter Quoting Zone Bypass Vulnerability Source: CERT Type: US Government Resource TA04-070A Source: MS Type: UNKNOWN MS04-009 Source: XF Type: UNKNOWN outlook-mailtourl-execute-code(15414) Source: XF Type: UNKNOWN outlook-mailtourl-execute-code(15414) Source: XF Type: UNKNOWN outlook-ms04009-patch(15429) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:843 | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||