PT-2008-3743 · Microsoft · Outlook Web Access+1

Michael Jordan · Publicado 2008-07-08 · Atualizado 2020-04-09 · CVE-2008-2248

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Outlook Web Access (OWA) for Exchange Server 2003 SP2

Description: The issue is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML. Exploitation could lead to elevation of privilege on individual OWA clients, enabling actions such as reading, sending, and deleting email as the logged-on user. This can be achieved by convincing a user to open a specially crafted email that runs malicious script within an individual OWA client.

Recommendations: For Outlook Web Access (OWA) for Exchange Server 2003 SP2, consider restricting access to potentially vulnerable HTML elements until a patch is available. As a temporary workaround, avoid using OWA to open suspicious or unsolicited emails.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-2248

Produtos afetados

Exchange Server

Outlook Web Access

Referências · 12

• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-039 · Nota
• http://secunia.com/advisories/30964 · Nota
• http://securityfocus.com/bid/30078 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2248 · Nota de Segurança
• http://vupen.com/english/advisories/2008/2021/references · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-039 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-2248 · Nota de Segurança
• http://us-cert.gov/cas/techalerts/TA08-190A.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43329 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2248 · Nota
• http://securitytracker.com/id?1020439 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5695 · Nota