PT-2015-5401 · Microsoft · Outlook Web App+3

Published 2015-03-10 · Updated 2018-10-12 · CVE-2015-1628

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2013 SP1 Microsoft Exchange Server Cumulative Update 7

Description The issue is related to a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML. This can be achieved via a crafted X-OWA-Canary cookie in an AD.RecipientType.User action. Elevation of privilege vulnerabilities also exist due to improper sanitization of page content in Outlook Web App, which could allow an attacker to run script in the context of the current user by convincing users to browse to a targeted site after modifying certain properties.

Recommendations For Microsoft Exchange Server 2013 SP1, update to a version that properly sanitizes page content in Outlook Web App to prevent elevation of privilege. For Microsoft Exchange Server Cumulative Update 7, restrict access to the Outlook Web App site until a patch is available to prevent exploitation of the XSS vulnerability. As a temporary workaround, consider disabling the use of the X-OWA-Canary cookie in AD.RecipientType.User actions until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-1628

Affected Products

Exchange Server

Exchange Server 2013 Sp1

Exchange Server Cumulative Update 7

Outlook Web App

References · 6

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1628 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-1628 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-026 · Vendor Advisory
• http://technet.microsoft.com/security/bulletin/ms15-026 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1628 · Note
• http://securitytracker.com/id/1031900 · Note