4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.112 Low
EPSS
Percentile
95.1%
When Internet Explorer accesses a website using MHTML (MIME Encapsulation of Aggregate HTML), Internet Explorer processes the contents as MHTML data, ignoring their actual content types, and it does not properly handle the Content-Disposition header field. This could cause a dialog box not to be displayed when downloading.
The MHTML protocol handler is included in Outlook Express component, and Microsoft provides the fix for this componet.
An arbitrary script could be executed without explicit user consent, as the download dialog box is not displayed on the userโs IE.
Update the Software
Apply the updates provided by the vendor.
For more information, refer to the vendorโs website.
Some versions of Outlook Express are affected because the vulnerability is contained in Outlook Express component used by Internet Explorer.