PT-2008-3743 · Microsoft · Outlook Web Access+1

Michael Jordan · Published 2008-07-08 · Updated 2020-04-09 · CVE-2008-2248

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Outlook Web Access (OWA) for Exchange Server 2003 SP2

Description: The issue is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML. Exploitation could lead to elevation of privilege on individual OWA clients, enabling actions such as reading, sending, and deleting email as the logged-on user. This can be achieved by convincing a user to open a specially crafted email that runs malicious script within an individual OWA client.

Recommendations: For Outlook Web Access (OWA) for Exchange Server 2003 SP2, consider restricting access to potentially vulnerable HTML elements until a patch is available. As a temporary workaround, avoid using OWA to open suspicious or unsolicited emails.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-2248

Affected Products

Exchange Server

Outlook Web Access

References · 12

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2248 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-039 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2248 · Security Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-039 · Note
• http://secunia.com/advisories/30964 · Note
• http://securityfocus.com/bid/30078 · Note
• http://vupen.com/english/advisories/2008/2021/references · Note
• http://us-cert.gov/cas/techalerts/TA08-190A.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43329 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2248 · Note
• http://securitytracker.com/id?1020439 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5695 · Note