CVE-2010-2091 Microsoft Outlook Web Access (OWA) 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is used, does not properly handle the id parameter in a Folder IPF.Note action to the default URI, which m...
MediumCVSS 4.3
EPSS 17.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Microsoft Outlook Web Access (OWA) 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is used, does not properly handle the id parameter in a Folder IPF.Note action to the default URI, which might allow remote attackers to obtain sensitive information or conduct cross-site scripting (XSS) attacks via an invalid value.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft exchange server | = 2007-sp2_update_rollup_4 | No fix listed |
References
- 12728 exploit third-party-advisory vdb-entry
- 20100520 Microsoft Outlook Web Access (OWA) v8.2.254.0 "id" parameter Information Disclosure Vulnerability mailing-list third-party-advisory vdb-entry
- 20100521 Re: Microsoft Outlook Web Access (OWA) v8.2.254.0 "id" parameter Information Disclosure Vulnerability mailing-list third-party-advisory vdb-entry
- 20100525 Re: Microsoft Outlook Web Access (OWA) v8.2.254.0 "id" parameter Information Disclosure Vulnerability mailing-list third-party-advisory vdb-entry
- ms-owa-id-xss(58835) vdb-entry