PT-2014-1677 · Microsoft · Lync Server

Published 2014-06-10 · Updated 2018-10-12 · CVE-2014-1823

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Lync Server versions 2010 through 2013

Description The issue is related to a cross-site scripting (XSS) vulnerability, which allows an attacker to inject arbitrary web script or HTML via a crafted URL containing a valid meeting ID. This vulnerability is due to incorrect handling (sanitization) of specially crafted content. In the case of a successful exploit, an attacker may be able to execute scripts in the user's browser and gain access to web session information.

Recommendations For Microsoft Lync Server versions 2010 through 2013, consider restricting access to the Web Components Server as a temporary workaround until a patch is available. Avoid using crafted URLs that may trigger the vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-00613

CVE-2014-1823

Affected Products

Lync Server

References · 9

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1823 · Security Note
• http://blogs.technet.com/b/srd/archive/2014/06/10/assessing-risk-for-the-june-2014-security-updates.aspx · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00613 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-1823 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-032 · Vendor Advisory
• http://securityfocus.com/bid/67893 · Note
• http://securitytracker.com/id/1030381 · Note
• http://secunia.com/advisories/58537 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms14-032 · Note