{"api_version":"1","generated_at":"2026-07-23T07:34:12+00:00","cve":"CVE-2003-1378","urls":{"html":"https://cve.report/CVE-2003-1378","api":"https://cve.report/api/cve/CVE-2003-1378.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2003-1378","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2003-1378"},"summary":{"title":"CVE-2003-1378","description":"Microsoft Outlook Express 6.0 and Outlook 2000, with the security zone set to Internet Zone, allows remote attackers to execute arbitrary programs via an HTML email with the CODEBASE parameter set to the program, a vulnerability similar to CAN-2002-0077.","state":"PUBLISHED","assigner":"mitre","published_at":"2003-12-31 05:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"8.8","severity":"","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:N","baseScore":8.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/6923","name":"http://www.securityfocus.com/bid/6923","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Microsoft Outlook and Outlook Express Arbitrary Program Execution Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/11411","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/11411","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/312929","name":"http://www.securityfocus.com/archive/1/312929","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus HOME Mailing List: BugTraq","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/312910","name":"http://www.securityfocus.com/archive/1/312910","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"SecurityFocus HOME Mailing List: BugTraq","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2003-1378","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2003-1378","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2003","cve_id":"1378","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"outlook","cpe6":"2000","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2003","cve_id":"1378","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"outlook","cpe6":"2000","cpe7":"sp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2003","cve_id":"1378","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"outlook","cpe6":"2000","cpe7":"sr1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2003","cve_id":"1378","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"outlook_express","cpe6":"6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-08T02:28:03.433Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20030223 O UT LO OK  E  XPRE SS 6 .00 : broken","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/312910"},{"name":"outlook-codebase-execute-programs(11411)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/11411"},{"name":"6923","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/6923"},{"name":"20030224 Re: O UT LO OK  E  XPRE SS 6 .00 : broken","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/312929"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2003-02-23T00:00:00.000Z","descriptions":[{"lang":"en","value":"Microsoft Outlook Express 6.0 and Outlook 2000, with the security zone set to Internet Zone, allows remote attackers to execute arbitrary programs via an HTML email with the CODEBASE parameter set to the program, a vulnerability similar to CAN-2002-0077."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"20030223 O UT LO OK  E  XPRE SS 6 .00 : broken","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/312910"},{"name":"outlook-codebase-execute-programs(11411)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/11411"},{"name":"6923","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/6923"},{"name":"20030224 Re: O UT LO OK  E  XPRE SS 6 .00 : broken","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/312929"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2003-1378","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Microsoft Outlook Express 6.0 and Outlook 2000, with the security zone set to Internet Zone, allows remote attackers to execute arbitrary programs via an HTML email with the CODEBASE parameter set to the program, a vulnerability similar to CAN-2002-0077."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20030223 O UT LO OK  E  XPRE SS 6 .00 : broken","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/312910"},{"name":"outlook-codebase-execute-programs(11411)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/11411"},{"name":"6923","refsource":"BID","url":"http://www.securityfocus.com/bid/6923"},{"name":"20030224 Re: O UT LO OK  E  XPRE SS 6 .00 : broken","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/312929"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2003-1378","datePublished":"2007-10-19T10:00:00.000Z","dateReserved":"2007-10-18T00:00:00.000Z","dateUpdated":"2024-08-08T02:28:03.433Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2003-12-31 05:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:N","baseScore":8.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"NONE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":9.2,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:outlook:2000:*:*:*:*:*:*:*","matchCriteriaId":"D52F17AB-2C87-4C1A-91B5-267ABBCF5844"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:outlook:2000:sp2:*:*:*:*:*:*","matchCriteriaId":"8A343E57-CF86-4500-96D2-7172B93808BE"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:outlook:2000:sr1:*:*:*:*:*:*","matchCriteriaId":"52A5E941-25A7-405E-B330-8101D6829B43"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:outlook_express:6.0:*:*:*:*:*:*:*","matchCriteriaId":"85FD3557-956D-4A96-8AA5-5FD9DB87FD11"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2003","CveId":"1378","Ordinal":"1","Title":"CVE-2003-1378","CVE":"CVE-2003-1378","Year":"2003"},"notes":[{"CveYear":"2003","CveId":"1378","Ordinal":"1","NoteData":"Microsoft Outlook Express 6.0 and Outlook 2000, with the security zone set to Internet Zone, allows remote attackers to execute arbitrary programs via an HTML email with the CODEBASE parameter set to the program, a vulnerability similar to CAN-2002-0077.","Type":"Description","Title":"CVE-2003-1378"},{"CveYear":"2003","CveId":"1378","Ordinal":"2","NoteData":"2007-10-19","Type":"Other","Title":"Published"},{"CveYear":"2003","CveId":"1378","Ordinal":"3","NoteData":"2017-07-28","Type":"Other","Title":"Modified"}]}}}