CVE-2007-0220 — Cross-site Scripting in Microsoft Exchange Server

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.8MEDIUMNVD
EPSS
43.7%
top 2.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Microsoft Exchange Server
Timeline
PublishedMay 8
Latest updateMay 1

Description

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an "incorrectly handled UTF character set label".

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages1 packages

▶NVDmicrosoft/exchange_server2000, 2003+1

Patches

Patch: docs.microsoft.com ↗Patch: docs.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-88qq-62qw-v7mh: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attacke↗2022-05-01
▶
CVEList
CVE-2007-0220: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attacke↗2007-05-08
▶
CVE-2007-0220 — Cross-site Scripting in Microsoft | cvebase