CVE-2008-1448 Information disclosure in n/a

What is CVE-2008-1448?

CVE-2008-1448 is a high-severity vulnerability in n/a, published on 13 Aug 2008. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to UNC share pathnames, which allows remote attackers to bypass intended access restrictions and read arbitrary files via an mhtml: URI in conjunction with a redirection, aka "URL Parsing Cross-Domain Information Disclosure Vulnerability."

Weakness: CWE-264

Which versions are affected by CVE-2008-1448?

It affects 2 products.

Products include Microsoft Outlook Express, Microsoft Windows Mail.

How do I fix CVE-2008-1448?

No fix has been published for CVE-2008-1448 yet. Limit exposure of the affected software until one is available.

Is CVE-2008-1448 being exploited?

There is no known exploitation of CVE-2008-1448 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2004-0380 Security feature bypass in n/a Critical 10.0
• CVE-2010-3147 Path traversal in n/a Critical 9.3
• CVE-2010-0816 Integer overflow in n/a Critical 9.3
• CVE-2007-3897 Memory corruption in n/a Critical 9.3
• CVE-2001-1547 Security feature bypass in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8xj3-mf49-rfmm.