PT-2014-7156 · Microsoft · Outlook Web App+3

Published 2014-12-09 · Updated 2018-10-12 · CVE-2014-6325

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2013 SP1 Microsoft Exchange Server Cumulative Update 6

Description The issue allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Elevation of privilege is possible when the server does not properly validate input, allowing an attacker to run script in the context of the current user. This could enable the attacker to read unauthorized content, use the victim's identity to take actions on the Outlook Web App site, and inject malicious content in the victim's browser. Exploitation requires a user to click a specially crafted URL that takes the user to a targeted Outlook Web App site.

Recommendations For Microsoft Exchange Server 2013 SP1, update to a version that properly validates input to prevent elevation of privilege. For Microsoft Exchange Server Cumulative Update 6, consider restricting access to the Outlook Web App site until a patch is available that addresses the input validation issue. As a temporary workaround, consider warning users about the risks of clicking specially crafted URLs that could lead to malicious activities on the Outlook Web App site.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-6325

Affected Products

Exchange Server

Exchange Server 2013 Sp1

Exchange Server Cumulative Update 6

Outlook Web App

References · 5

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-075 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-6325 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6325 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6325 · Note
• http://technet.microsoft.com/security/bulletin/ms14-075 · Note