CVE-2001-0660: Microsoft Exchange Server

Medium severity, CVSS 5.0. EPSS: 22% chance of exploitation in the next 30 days.

Outlook Web Access (OWA) in Microsoft Exchange 5.5, SP4 and earlier, allows remote attackers to identify valid user email addresses by directly accessing a back-end function that processes the global address list (GAL).

Affected products

• Microsoft Exchange Server: up to and including 5.5

Published 2001-10-30. Last modified 2026-06-16.