cbcvebase.
CVE-2004-0501
published 2004-08-18

CVE-2004-0501: Outlook 2003 allows remote attackers to bypass intended access restrictions and cause Outlook to request a URL from a remote site via an HTML e-mail message…

PriorityP424medium5CVSS 2.0
AVNACLAuNCPINAN
EXPLOIT
EPSS
18.74%
97.3th percentile
Outlook 2003 allows remote attackers to bypass intended access restrictions and cause Outlook to request a URL from a remote site via an HTML e-mail message containing a Vector Markup Language (VML) entity whose src parameter points to the remote site, which could allow remote attackers to know when a message has been read, verify valid e-mail addresses, and possibly leak other information.

Affected

1 ranges
VendorProductVersion rangeFixed in
microsoftoutlook——

Detection & IOCsextracted from sources · hover to see the quote

otherv\:* { behavior: url(#default#VML); }↗
  • →Look for HTML e-mail messages containing Vector Markup Language (VML) entities with a remote `src` parameter — this triggers an outbound HTTP request from Outlook 2003 to an attacker-controlled URL, enabling read-receipt tracking and e-mail address harvesting. ↗
  • →Detect the VML CSS behavior declaration `v\:* { behavior: url(#default#VML); }` in inbound HTML e-mail bodies as an indicator of a CVE-2004-0501 exploitation attempt. ↗
  • →Monitor outbound HTTP/HTTPS requests originating from the Outlook 2003 process (outlook.exe) triggered by e-mail rendering — unexpected GET requests to remote hosts while reading mail may indicate VML src-based beacon exploitation. ↗
  • ·The vulnerability is specific to Microsoft Outlook 2003; other versions are not confirmed affected. ↗
  • ·Exploitation relies on Outlook rendering HTML e-mail with VML support enabled — environments with plain-text e-mail rendering or VML disabled are not susceptible. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.