CVE-2008-1448
- State
- Published
- Severity
- Not scored
- Published
- Aug 13, 2008
- Updated
- Aug 7, 2024
- Reserved
- Mar 21, 2008
Description
The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to UNC share pathnames, which allows remote attackers to bypass intended access restrictions and read arbitrary files via an mhtml: URI in conjunction with a redirection, aka "URL Parsing Cross-Domain Information Disclosure Vulnerability."
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 1020679vdb-entry
- 30585vdb-entry
- TA08-225Athird-party-advisory
- http://www.coresecurity.com/content/internet-explorer-zone-elevation
- MS08-048vendor-advisory
- 1020680vdb-entry
- HPSBST02360vendor-advisory
- 20080813 CORE-2008-0103: Internet Explorer Zone Elevation Restrictions Bypass and Security Zone Restrictions Bypassmailing-list
- 31415third-party-advisory
- ADV-2008-2352vdb-entry
- oval:org.mitre.oval:def:5886vdb-entrysignature
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.