CVE-2008-2247: XSS

Published Jul 8, 2008

Updated

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified e-mail fields, a different vulnerability than CVE-2008-2248.

Affected Software

3 affected components

Microsoft Exchange Server=2003-sp2

Microsoft Exchange Server=2007-sp1

Microsoft Exchange Server=2007

Remediation

Patch Available

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-039

Event History

Jul 8, 2008

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-2247?

CVE-2008-2247 is classified as a moderate severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2008-2247?

To fix CVE-2008-2247, it is recommended to apply the latest security patches provided by Microsoft for Exchange Server.

Which versions of Exchange Server are affected by CVE-2008-2247?

CVE-2008-2247 affects Microsoft Exchange Server 2003 SP2 and Exchange Server 2007 SP1 or 2007.

What kind of attacks can be executed through CVE-2008-2247?

Attackers can exploit CVE-2008-2247 to inject arbitrary web scripts or HTML into Outlook Web Access sessions.

Is CVE-2008-2247 still a risk for current Exchange Server users?

Yes, CVE-2008-2247 poses a risk for users who have not updated their Exchange Server installations that are still in use.