Detections
Analytics
MS04-026: Vulnerability in Exchange Server 5.5 Outlook Web Access XSS (842436)
medium Nessus Plugin ID 14254
Synopsis
The remote web server runs a script vulnerable to cross-site scripting attacks.Description
The remote host runs Outlook Web Access.Outlook Web Access is a service for Microsoft Exchange, that provides web-based email, calendaring and contact management to end users.
The remote version of Outlook Web Access is vulnerable to a cross-site scripting attack that could allow an attacker to execute arbitrary java script in the security context of a victim using this service.
To exploit this flaw, an attacker would need to send a specially crafted message to a victim using Outlook Web Access. When the victim reads the message, the bug in Outlook Web Access triggers and cause the execution of the script sent by the attacker.
Solution
Microsoft has released a set of patches for OWA for Exchange 5.5.See Also
https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2004/ms04-026
Plugin Details
Severity: Medium
ID: 14254
File Name: smb_nt_ms04-026.nasl
Version: 1.36
Type: local
Agent: windows
Family: Windows : Microsoft Bulletins
Published: 8/10/2004
Updated: 11/15/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.7
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/o:microsoft:windows, cpe:/a:microsoft:exchange_server
Required KB Items: SMB/MS_Bulletin_Checks/Possible
Exploit Ease: No known exploits are available
Patch Publication Date: 8/10/2004
Vulnerability Publication Date: 8/10/2004
Reference Information
CVE: CVE-2004-0203
BID: 10902