An interaction between the Outlook Web Access (OWA) service in Microsoft Exchange 2000 Server and Internet Explorer allows attackers to execute malicious script code against a user's mailbox via a message attachment that contains HTML code, which is executed automatically.

References

• https://nvd.nist.gov/vuln/detail/CVE-2001-0340
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-030
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6652
• http://www.ciac.org/ciac/bulletins/l-091.shtml