CVE-2013-5072: XSS

Published Dec 11, 2013

Updated

Cross-site scripting (XSS) vulnerability in Outlook Web Access in Microsoft Exchange Server 2010 SP2 and SP3 and 2013 Cumulative Update 2 and 3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability."

Affected Software

4 affected components

Microsoft Exchange Server=2010-sp2

Microsoft Exchange Server=2010-sp3

Microsoft Exchange Server=2013-cumulative_update_2

Microsoft Exchange Server=2013-cumulative_update_3

Event History

Dec 11, 2013

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-5072?

CVE-2013-5072 is classified as a critical vulnerability, allowing attackers to execute arbitrary web scripts.

How do I fix CVE-2013-5072?

To fix CVE-2013-5072, it is recommended to apply the latest security updates provided by Microsoft for the affected Exchange Server versions.

What versions of Microsoft Exchange Server are impacted by CVE-2013-5072?

CVE-2013-5072 affects Microsoft Exchange Server 2010 SP2, 2010 SP3, and 2013 Cumulative Update 2 and 3.

What type of vulnerability is CVE-2013-5072?

CVE-2013-5072 is a cross-site scripting (XSS) vulnerability that allows for the injection of arbitrary web scripts or HTML.

Can CVE-2013-5072 lead to data breaches?

Yes, CVE-2013-5072 can potentially lead to data breaches by allowing attackers to execute scripts in the context of users' sessions.