CVE-2007-0220: XSS

Published May 8, 2007

Updated

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an "incorrectly handled UTF character set label".

Affected Software

3 affected components

Microsoft Exchange Server=2000-sp3

Microsoft Exchange Server=2003-sp1

Microsoft Exchange Server=2003-sp2

Remediation

Patch Available

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-026

Event History

May 8, 2007

CVE Published

11:19 PM

May 9, 2007

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-0220?

CVE-2007-0220 is considered to be of high severity due to its potential for remote attackers to execute arbitrary scripts.

How do I fix CVE-2007-0220?

To fix CVE-2007-0220, it is recommended to apply the latest security updates from Microsoft for Exchange Server 2000 and 2003.

What are the affected versions in CVE-2007-0220?

CVE-2007-0220 affects Microsoft Exchange Server 2000 SP3 and 2003 SP1/SP2.

What types of attacks are possible due to CVE-2007-0220?

CVE-2007-0220 can lead to cross-site scripting (XSS) attacks, allowing attackers to spoof content or gain sensitive information.

Who is most at risk from CVE-2007-0220?

Organizations using the vulnerable versions of Microsoft Exchange Server are most at risk from CVE-2007-0220.