CVE-2004-2137

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 26.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-12-31 · updated 2026-06-16

Description

Outlook Express 6.0, when sending multipart e-mail messages using the "Break apart messages larger than" setting, leaks the BCC recipients of the message to the addresses listed in the To and CC fields, which may allow remote attackers to obtain sensitive information.

Affected products

Microsoft Outlook Express: 6.0, 6.0-sp1

References

http://secunia.com/advisories/12376
http://securitytracker.com/id?1011067
http://support.microsoft.com/kb/843555
http://www.networksecurity.fi/advisories/outlook-bcc.html
http://www.osvdb.org/9167
http://www.securityfocus.com/bid/11040
https://exchange.xforce.ibmcloud.com/vulnerabilities/17098
http://secunia.com/advisories/12376
http://securitytracker.com/id?1011067
http://support.microsoft.com/kb/843555
http://www.networksecurity.fi/advisories/outlook-bcc.html
http://www.osvdb.org/9167

Get alerted when CVE-2004-2137 or the next vulnerability affects your stack