PT-2015-1997 · Microsoft · Outlook Web Access+1

Published 2015-09-08 · Updated 2018-10-12 · CVE-2015-2543

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2013 Cumulative Update 8 and 9

Description A cross-site scripting (XSS) issue exists due to insufficient protection of the web page structure in Outlook Web Access (OWA) of Microsoft Exchange Server. This allows remote attackers to inject arbitrary web script or HTML via a crafted email message. An authenticated attacker could exploit this by sending a specially crafted email to a user, potentially leading to HTML injection attacks and attempts to trick the user into disclosing sensitive information. The user must click a specially crafted URL for the exploitation to be successful.

Recommendations For Microsoft Exchange Server 2013 Cumulative Update 8 and 9, consider disabling the OWA component until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to specially crafted email messages to minimize the risk of HTML injection attacks. Avoid clicking on suspicious URLs received via email to prevent potential exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-11343

CVE-2015-2543

Affected Products

Exchange Server

Outlook Web Access

References · 8

• https://bdu.fstec.ru/vul/2015-11343 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-2543 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2543 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-103 · Vendor Advisory
• http://technet.microsoft.com/security/bulletin/MS15-103 · Note
• http://technet.microsoft.com/security/bulletin/ms15-103 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2543 · Note
• http://securitytracker.com/id/1033495 · Note