CVE-2002-1696 Information disclosure in n/a

Medium 5.5 Published 21 Jun 2005 Updated 8 Aug 2024

Attackers can read decrypted email content saved to disk when specific Outlook PGP plugin settings are enabled during replies.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2002-1696?

CVE-2002-1696 is a medium-severity vulnerability in n/a, published on 21 Jun 2005. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Microsoft Outlook plug-in PGP version 7.0, 7.0.3, and 7.0.4 silently saves a decrypted copy of a message to hard disk when "Automatically decrypt/verify when opening messages" option is checked, "Always use Secure Viewer when decrypting" option is not checked, and the user replies to an encrypted message.

Weakness: CWE-312

Which versions are affected by CVE-2002-1696?

It affects 1 product.

Products include Pgp Personal Privacy.

How do I fix CVE-2002-1696?

No fix has been published for CVE-2002-1696 yet. Limit exposure of the affected software until one is available.

Is CVE-2002-1696 being exploited?

There is no known exploitation of CVE-2002-1696 in the wild and no public exploit code.

Sources

Also known as GHSA-cvr6-jvr3-rqhf.