CVE-2010-2091: XSS
Microsoft Outlook Web Access (OWA) 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is used, does not properly handle the id parameter in a Folder IPF.Note action to the default URI, which might allow remote attackers to obtain sensitive information or conduct cross-site scripting (XSS) attacks via an invalid value.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2091?
CVE-2010-2091 has a medium severity rating due to its potential to expose sensitive information and enable cross-site scripting attacks.
How do I fix CVE-2010-2091?
To mitigate CVE-2010-2091, it is recommended to update Microsoft Exchange Server 2007 to the latest service pack or security rollup that addresses this vulnerability.
Which versions of software are affected by CVE-2010-2091?
CVE-2010-2091 specifically affects Microsoft Exchange Server 2007 with SP2 Update Rollup 4 when accessed via Internet Explorer 7 on Windows Server 2003.
Can CVE-2010-2091 lead to cross-site scripting attacks?
Yes, CVE-2010-2091 can allow remote attackers to conduct cross-site scripting attacks through improper handling of the id parameter.
What kind of information could be exposed by CVE-2010-2091?
CVE-2010-2091 may expose sensitive information stored in folders accessed through Outlook Web Access due to inadequate validation of user input.