Nessus Plugin #17636

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

Outlook Web Access URL Injection

Family:

CGI abuses : XSS

Category:

infos

Copyright:

This script is Copyright (C) 2005 Michael J. Richardson

Summary:

The remote host is running Microsoft Outlook Web Access 2003 and is vulnerable to URL Injection.

Version:

$Revision: 1.1 $

Cve_id:

-

Bugtraq_id:

12459

Xrefs:

-

Description:

The remote host is running Microsoft Outlook Web Access 2003.

Due to a lack of santization of the user input, the remote version of this software
is vulnerable to URL injection which can be exploited to redirect a user to a different,
unauthorized web server after authenticating to OWA. This unauthorized site could be
used to capture sensitive information by appearing to be part of the web application.

See also : http://exploitlabs.com/files/advisories/EXPL-A-2005-001-owa.txt
Solution : None at this time
Risk factor : Medium