6.8 - MS03-047

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Informations
Name	MS03-047	First vendor Publication	N/A
Vendor	Microsoft	Last vendor Modification	N/A
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score	6.8	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability in Exchange Server 5.5 Outlook Web Access Could Allow Cross-Site Scripting Attack (828489)

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-79	Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

CPE : Common Platform Enumeration

Type	Description	Count
Application	Microsoft Exchange Server cpe:2.3:a:microsoft:exchange_server:5.5:-:::::: cpe:2.3:a:microsoft:exchange_server:5.5:sp1:::::: cpe:2.3:a:microsoft:exchange_server:5.5:sp2:::::: cpe:2.3:a:microsoft:exchange_server:5.5:sp3:::::: cpe:2.3:a:microsoft:exchange_server:5.5:sp4::::::	5

Open Source Vulnerability Database (OSVDB)

Id	Description
2679	Microsoft Outlook Web Access XSS Microsoft Exchange Outlook Web Access (OWA) contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate user supplied input variables upon submission to the "Compose New Message" form. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Description

2679

Microsoft Outlook Web Access XSS

Microsoft Exchange Outlook Web Access (OWA) contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate user supplied input variables upon submission to the "Compose New Message" form. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.