CVE-2013-5072

2013-12-1100:55:04

CWE-79

microsoft

web.nvd.nist.gov

cve-2013-5072

owa

xss

outlook web access

microsoft exchange server

security vulnerability

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

Confidence

High

EPSS

0.822

Percentile

98.5%

JSON

Cross-site scripting (XSS) vulnerability in Outlook Web Access in Microsoft Exchange Server 2010 SP2 and SP3 and 2013 Cumulative Update 2 and 3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka “OWA XSS Vulnerability.”

Affected configurations

Nvd

Node

microsoftexchange_serverMatch2010sp2

microsoftexchange_serverMatch2010sp3

microsoftexchange_serverMatch2013cumulative_update_2

microsoftexchange_serverMatch2013cumulative_update_3

VendorProductVersionCPE
microsoftexchange_server2010cpe:2.3:a:microsoft:exchange_server:2010:sp2:*:*:*:*:*:*
microsoftexchange_server2010cpe:2.3:a:microsoft:exchange_server:2010:sp3:*:*:*:*:*:*
microsoftexchange_server2013cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_2:*:*:*:*:*:*
microsoftexchange_server2013cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_3:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	exchange_server	2010	cpe:2.3:a:microsoft:exchange_server:2010:sp2::::::
microsoft	exchange_server	2010	cpe:2.3:a:microsoft:exchange_server:2010:sp3::::::
microsoft	exchange_server	2013	cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_2::::::
microsoft	exchange_server	2013	cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_3::::::