CVE-2002-2101: High severity Microsoft Outlook vulnerability
Microsoft Outlook 2002 allows remote attackers to execute arbitrary JavaScript code, even when scripting is disabled, via an "about:" or "javascript:" URI in the href attribute of an "a" tag.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
At the email gateway or inbound-content filter, strip, neutralize, or rewrite href values that begin with the 'javascript:' or 'about:' URI schemes in HTML email (for example, remove href attributes whose value starts with 'javascript:' or 'about:' or replace them with a safe placeholder) to prevent execution of script when messages are opened in Microsoft Outlook 2002.
Event History
Frequently Asked Questions
What is the severity of CVE-2002-2101?
CVE-2002-2101 is considered to have a high severity as it allows remote code execution through arbitrary JavaScript.
How do I fix CVE-2002-2101?
To fix CVE-2002-2101, ensure that you apply any available security patches from Microsoft for Outlook 2002.
Which versions of Outlook are affected by CVE-2002-2101?
CVE-2002-2101 specifically affects Microsoft Outlook 2002.
What type of attack does CVE-2002-2101 enable?
CVE-2002-2101 enables attackers to execute arbitrary JavaScript code on a victim's system.
Can scripting be disabled to mitigate CVE-2002-2101?
No, CVE-2002-2101 can execute JavaScript even when scripting is disabled, making it particularly dangerous.