Vulnerability CVE-2010-2091

Vulnerability Name:

CVE-2010-2091 (CCN-58835)

Assigned:

2010-05-24

Published:

2010-05-24

Updated:

2020-04-09

Summary:

Microsoft Outlook Web Access (OWA) 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is used, does not properly handle the id parameter in a Folder IPF.Note action to the default URI, which might allow remote attackers to obtain sensitive information or conduct cross-site scripting (XSS) attacks via an invalid value.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
4.1 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:U/RC:UR)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
4.1 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:U/RC:UR)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-79

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2010-2091

Source: EXPLOIT-DB
Type: Exploit, Third Party Advisory, VDB Entry
12728

Source: CCN
Type: Microsoft Web site
Microsoft Exchange Server Outlook Web Access Web Administration

Source: CCN
Type: OSVDB ID: 64980
Microsoft Outlook Web Access (OWA) URI id Parameter Information Disclosure

Source: BUGTRAQ
Type: Third Party Advisory, VDB Entry
20100520 Microsoft Outlook Web Access (OWA) v8.2.254.0 "id" parameter Information Disclosure Vulnerability

Source: BUGTRAQ
Type: Third Party Advisory, VDB Entry
20100521 Re: Microsoft Outlook Web Access (OWA) v8.2.254.0 "id" parameter Information Disclosure Vulnerability

Source: BUGTRAQ
Type: Third Party Advisory, VDB Entry
20100525 Re: Microsoft Outlook Web Access (OWA) v8.2.254.0 "id" parameter Information Disclosure Vulnerability

Source: XF
Type: UNKNOWN
ms-owa-id-xss(58835)

Source: XF
Type: VDB Entry
ms-owa-id-xss(58835)

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [05-24-2010]

Vulnerable Configuration:

Configuration 1:

cpe:/a:microsoft:exchange_server:2007:sp2_update_rollup_4:*:*:*:*:*:*

AND

cpe:/a:microsoft:internet_explorer:7:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:-:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK