Unscored severity · published Dec 31, 2004
CVE-2004-2137
Outlook Express 6.0, when sending multipart e-mail messages using the "Break apart messages larger than" setting, leaks the BCC recipients of the message to the addresses listed…
–
CVSS
26.1%
EPSS
No
On KEV
Description
Outlook Express 6.0, when sending multipart e-mail messages using the "Break apart messages larger than" setting, leaks the BCC recipients of the message to the addresses listed in the To and CC fields, which may allow remote attackers to obtain sensitive information.
Exploitation
Is it being used?
Exploit prediction (EPSS)26.1% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OE
Outlook Express · Microsoft
6.0; 6.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-2137
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-2137
Patch
http://secunia.com/advisories/12376
Patch
http://securitytracker.com/id?1011067
Patch
http://support.microsoft.com/kb/843555
Patch
http://www.networksecurity.fi/advisories/outlook-bcc.html
www.osvdb.org
http://www.osvdb.org/9167
www.securityfocus.com
http://www.securityfocus.com/bid/11040
More from Outlook Express
8.8
CVE-2007-4040
Argument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting…
–
CVE-2010-3147
Untrusted search path vulnerability in wab.exe 6.00.2900.5512 in Windows Address Book in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2,…
–
CVE-2010-0816
Integer overflow in inetcomm.dll in Microsoft Outlook Express 5.5 SP2, 6, and 6 SP1; Windows Live Mail on Windows XP SP2 and SP3, Windows Vista SP1 and SP2, Windows Server 2008…
–
CVE-2008-5424
The MimeOleClearDirtyTree function in InetComm.dll in Microsoft Outlook Express 6.00.2900.5512 does not properly handle (1) multipart/mixed e-mail messages with many MIME parts…
–
CVE-2008-1448
The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to…