Adrian Ivascu

The issue is related to insufficient access restrictions in the Exchange Outlook Web Access (OWA) component of Microsoft Exchange Server. It can be exploited by a remote attacker who sends a specially crafted email with a malicious link to a user, potentially leading to the disclosure of protected information. The vulnerability can also be used to perform script or content injection attacks, attempting to trick the user into revealing sensitive information. This requires the user to click on a maliciously crafted link sent by the attacker.

An elevation of privilege issue exists due to improper sanitization of specially crafted web requests. An authenticated attacker can exploit this by sending a crafted request, potentially leading to cross-site scripting attacks. This could allow the attacker to read unauthorized content, use the victim's identity to change permissions or delete content, and inject malicious content into the user's browser.

Name of the Vulnerable Software and Affected Versions: Microsoft Access in Microsoft SharePoint Enterprise Server versions prior to the fixed version Description: A cross-site-scripting (XSS) issue exists due to improper sanitization of inputs to image fields edited within Design view. This could allow an attacker to run javascript in the security context of the current user, potentially enabling them to read unauthorized content, use the victim's identity to take actions on a remote site, and inject malicious content into the user's browser. Recommendations: For Microsoft Access in Microsoft SharePoint Enterprise Server, update to a version that includes the fix for this issue to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.