PT-2014-1676 · Microsoft · Lync Server 2013

Noam Rathaus · Publicado 2014-09-09 · Atualizado 2018-10-12 · CVE-2014-4070

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Lync Server 2013

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL. This is related to incorrect handling of specially crafted content, which can lead to the execution of scripts in a user's browser and access to web session information.

Recommendations For Microsoft Lync Server 2013, consider disabling the Web Components Server as a temporary workaround until a patch is available. Restrict access to the server to minimize the risk of exploitation. Avoid using crafted URLs that could trigger the XSS issue until the problem is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2015-00612

CVE-2014-4070

Produtos afetados

Lync Server 2013

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/95546 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-4070 · Nota de Segurança
• http://securitytracker.com/id/1030821 · Nota
• http://technet.microsoft.com/en-us/security/bulletin/ms14-055 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4070 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-055 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-00612 · Nota de Segurança
• http://securityfocus.com/bid/69579 · Nota