PT-2015-1997 · Microsoft · Outlook Web Access+1

Publicado 2015-09-08 · Atualizado 2018-10-12 · CVE-2015-2543

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2013 Cumulative Update 8 and 9

Description A cross-site scripting (XSS) issue exists due to insufficient protection of the web page structure in Outlook Web Access (OWA) of Microsoft Exchange Server. This allows remote attackers to inject arbitrary web script or HTML via a crafted email message. An authenticated attacker could exploit this by sending a specially crafted email to a user, potentially leading to HTML injection attacks and attempts to trick the user into disclosing sensitive information. The user must click a specially crafted URL for the exploitation to be successful.

Recommendations For Microsoft Exchange Server 2013 Cumulative Update 8 and 9, consider disabling the OWA component until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to specially crafted email messages to minimize the risk of HTML injection attacks. Avoid clicking on suspicious URLs received via email to prevent potential exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2015-11343

CVE-2015-2543

Produtos afetados

Exchange Server

Outlook Web Access

Referências · 8

• http://technet.microsoft.com/security/bulletin/MS15-103 · Nota
• https://bdu.fstec.ru/vul/2015-11343 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2015-2543 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/ms15-103 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2543 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2543 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-103 · Aviso do Fabricante
• http://securitytracker.com/id/1033495 · Nota