PT-2014-1676 · Microsoft · Lync Server 2013

Noam Rathaus · Published 2014-09-09 · Updated 2018-10-12 · CVE-2014-4070

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Lync Server 2013

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL. This is related to incorrect handling of specially crafted content, which can lead to the execution of scripts in a user's browser and access to web session information.

Recommendations For Microsoft Lync Server 2013, consider disabling the Web Components Server as a temporary workaround until a patch is available. Restrict access to the server to minimize the risk of exploitation. Avoid using crafted URLs that could trigger the XSS issue until the problem is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-00612

CVE-2014-4070

Affected Products

Lync Server 2013

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2014-4070 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4070 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-055 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00612 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95546 · Note
• http://securitytracker.com/id/1030821 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms14-055 · Note
• http://securityfocus.com/bid/69579 · Note