PT-2008-3106 · Microsoft · Outlook Web Access+1

Martin Suess · Published 2008-10-21 · Updated 2020-04-09 · CVE-2008-1547

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2 (aka build 6.5.7638)

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the URL parameter. This can be exploited by including a malicious URL in the URL parameter of the /exchweb/bin/redir.asp API endpoint.

Recommendations For Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2, consider restricting access to the /exchweb/bin/redir.asp API endpoint until a fix is available. Avoid using the URL parameter in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2008-1547

Affected Products

Exchange Server

Outlook Web Access

References · 11

• 🔥 https://exploit-db.com/exploits/32489 · Exploit
• 🔥 http://securityfocus.com/bid/31765 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1547 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46061 · Note
• http://securityfocus.com/archive/1/497374/100/0/threaded · Note
• http://securityfocus.com/archive/1/497534/100/0/threaded · Note
• http://securityreason.com/securityalert/4441 · Note
• http://securityfocus.com/archive/1/497500/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1547 · Note
• http://securityfocus.com/archive/1/497390/100/0/threaded · Note
• http://securityfocus.com/archive/1/497433/100/0/threaded · Note