CVE-2001-1088

CVE-2001-1088 describes a spoofing vulnerability in Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, when the "Automatically put people I reply to in my address book" option is enabled. An attacker can exploit this by sending an email with a manipulated "Reply-To" address that differs from the "From" address. This allows the attacker to intercept replies intended for the legitimate sender, as the user is not notified of the discrepancy. The vulnerability carries a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity, requiring no authentication, and potentially leading to partial confidentiality, integrity, and availability impacts. Its EPSS score is 0.35396, and it has a FAUCET Risk Score of 97/100. While there is no evidence of active exploitation in the wild, an ExploitDB entry (EDB-20899) exists, detailing address book spoofing for various Outlook versions. There is no Metasploit or Nuclei support, and community discussion and media coverage are minimal.