An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited this vulnerability could perform script/content injection attacks and attempt to trick the user into disclosing sensitive information. To exploit the vulnerability, an attacker could send a specially crafted email message containing a specific malicious script. The user would have to apply a highlight to the script for it to be activated. The security update addresses the vulnerability by correcting how Microsoft Exchange validates web requests.

Adrian Ivascu