Actu
Vigil@nce: Microsoft Exchange, Cross Site Scripting of OWA
July 2008 by Vigil@nce
An attacker can generate two Cross Site Scripting in OWA in order
to run operations in the context on the connected victime.
– Gravity: 2/4
– Consequences: user access/rights
– Provenance: internet client
– Means of attack: no proof of concept, no attack
– Ability of attacker: expert (4/4)
– Confidence: confirmed by the editor (5/5)
– Diffusion of the vulnerable configuration: high (3/3)
– Creation date: 09/07/2008
– Identifier: VIGILANCE-VUL-7940
IMPACTED PRODUCTS
Microsoft Exchange [confidential versions]
DESCRIPTION
The OWA (Outlook Web Access) service provides a web access where
users can read their emails or manage their calendar. It is
impacted by two Cross Site Scripting.
When an email is opened, some fields are not correctly filtered.
[grav:2/4; BID-30130, CVE-2008-2247]
When an email is displayed, some fields are not correctly
filtered. [grav:2/4; CVE-2008-2248]
An attacker can therefore execute JavaScript code in the context
of the OWA web site, in order for example to read or delete
victim’s emails.
CHARACTERISTICS
– Identifiers: 953747, BID-30130, CVE-2008-2247, CVE-2008-2248,
MS08-039, VIGILANCE-VUL-7940
– Url: https://vigilance.aql.fr/tree/1/7940
