CVE-2007-0220

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an "incorrectly handled UTF character set label".

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.kb.cert.org/vuls/id/124113	Third Party Advisory US Government Resource
http://www.securityfocus.com/bid/23806	Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1018015	Third Party Advisory VDB Entry
http://secunia.com/advisories/25183	Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA07-128A.html	Third Party Advisory US Government Resource
http://www.osvdb.org/34389	Broken Link
http://www.vupen.com/english/advisories/2007/1711	Permissions Required
https://exchange.xforce.ibmcloud.com/vulnerabilities/33887	Third Party Advisory VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1371	Third Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-026	Patch
http://www.securityfocus.com/archive/1/468871/100/200/threaded	Third Party Advisory VDB Entry

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:exchange_server:2000:sp3::::::
	cpe:2.3:a:microsoft:exchange_server:2003:sp1::::::
	cpe:2.3:a:microsoft:exchange_server:2003:sp2::::::

Information

Published : 2007-05-08 16:19

Updated : 2020-04-09 06:30

NVD link : CVE-2007-0220

Mitre link : CVE-2007-0220

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

microsoft

exchange_server

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.kb.cert.org/vuls/id/124113", "name": "VU#124113", "tags": ["Third Party Advisory", "US Government Resource"], "refsource": "CERT-VN"}, {"url": "http://www.securityfocus.com/bid/23806", "name": "23806", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://www.securitytracker.com/id?1018015", "name": "1018015", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/25183", "name": "25183", "tags": ["Third Party Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA07-128A.html", "name": "TA07-128A", "tags": ["Third Party Advisory", "US Government Resource"], "refsource": "CERT"}, {"url": "http://www.osvdb.org/34389", "name": "34389", "tags": ["Broken Link"], "refsource": "OSVDB"}, {"url": "http://www.vupen.com/english/advisories/2007/1711", "name": "ADV-2007-1711", "tags": ["Permissions Required"], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33887", "name": "exchange-utf-xss(33887)", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "XF"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1371", "name": "oval:org.mitre.oval:def:1371", "tags": ["Third Party Advisory"], "refsource": "OVAL"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-026", "name": "MS07-026", "tags": ["Patch"], "refsource": "MS"}, {"url": "http://www.securityfocus.com/archive/1/468871/100/200/threaded", "name": "HPSBST02214", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "HP"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an \"incorrectly handled UTF character set label\"."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-0220", "ASSIGNER": "secure@microsoft.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2007-05-08T23:19Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:exchange_server:2000:sp3:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:exchange_server:2003:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:exchange_server:2003:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2020-04-09T13:30Z"}