vendor:
Outlook Express
by:
SecurityFocus
8.8
CVSS
HIGH
HTML Injection
79
CWE
Product Name: Outlook Express
Affected Version From: Microsoft Outlook Express 5
Affected Version To: N/A
Patch Exists: No
Related CWE: N/A
CPE: o:microsoft:outlook_express:5
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows
2001
Microsoft Outlook Express 5 HTML Injection
Microsoft Outlook Express 5, and possibly other email clients that parse HTML messages, can be made to run Active Scripting that will read any new messages that arrive after the hostile code has been run. The exploit code uses a window.open() function to open a new window with a javascript alert that will display the contents of the message body.
Mitigation:
Users should avoid opening emails from untrusted sources.
