PT-2014-1677 · Microsoft · Lync Server

Publicado 2014-06-10 · Atualizado 2018-10-12 · CVE-2014-1823

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Lync Server versions 2010 through 2013

Description The issue is related to a cross-site scripting (XSS) vulnerability, which allows an attacker to inject arbitrary web script or HTML via a crafted URL containing a valid meeting ID. This vulnerability is due to incorrect handling (sanitization) of specially crafted content. In the case of a successful exploit, an attacker may be able to execute scripts in the user's browser and gain access to web session information.

Recommendations For Microsoft Lync Server versions 2010 through 2013, consider restricting access to the Web Components Server as a temporary workaround until a patch is available. Avoid using crafted URLs that may trigger the vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2015-00613

CVE-2014-1823

Produtos afetados

Lync Server

Referências · 9

• http://securityfocus.com/bid/67893 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1823 · Nota de Segurança
• http://blogs.technet.com/b/srd/archive/2014/06/10/assessing-risk-for-the-june-2014-security-updates.aspx · Aviso do Fabricante
• http://securitytracker.com/id/1030381 · Nota
• http://secunia.com/advisories/58537 · Nota
• https://bdu.fstec.ru/vul/2015-00613 · Nota de Segurança
• http://technet.microsoft.com/en-us/security/bulletin/ms14-032 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-1823 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-032 · Aviso do Fabricante