CVE-2001-1088

Published: Jun 5, 2001Modified: Apr 16, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the "Automatically put people I reply to in my address book" option enabled, do not notify the user when the "Reply-To" address is different than the "From" address, which could allow an untrusted remote attacker to spoof legitimate addresses and intercept email from the client that is intended for another user.

Affected (11)

Products: Microsoft: Outlook, Outlook Express

Microsoft

2 products

Outlook

Outlook Express

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Microsoft Outlook	Version 2000
Microsoft Outlook	Version 97
Microsoft Outlook	Version 98
Microsoft Outlook Express	Version 4.0
Microsoft Outlook Express	Version 4.27.3110
Microsoft Outlook Express	Version 4.5
Microsoft Outlook Express	Version 4.72.2106
Microsoft Outlook Express	Version 4.72.3120.0
Microsoft Outlook Express	Version 4.72.3612
Microsoft Outlook Express	Version 5.0
Microsoft Outlook Express	Version 5.5