MS04-026: Vulnerability in Exchange Server 5.5 Outlook Web Access XSS (842436)

Medium Nessus Plugin ID 14254


The remote web server runs a script vulnerable to cross-site scripting attacks.


The remote host runs Outlook Web Access.

Outlook Web Access is a service for Microsoft Exchange, that provides web-based email, calendaring and contact management to end users.

The remote version of Outlook Web Access is vulnerable to a cross-site scripting attack that could allow an attacker to execute arbitrary java script in the security context of a victim using this service.

To exploit this flaw, an attacker would need to send a specially crafted message to a victim using Outlook Web Access. When the victim reads the message, the bug in Outlook Web Access triggers and cause the execution of the script sent by the attacker.


Microsoft has released a set of patches for OWA for Exchange 5.5.

See Also

Plugin Details

Severity: Medium

ID: 14254

File Name: smb_nt_ms04-026.nasl

Version: $Revision: 1.34 $

Type: local

Agent: windows

Published: 2004/08/10

Modified: 2017/07/14

Dependencies: 13855, 57033

Risk Information

Risk Factor: Medium


Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/o:microsoft:windows, cpe:/a:microsoft:exchange_server

Required KB Items: SMB/MS_Bulletin_Checks/Possible

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2004/08/10

Vulnerability Publication Date: 2004/08/10

Reference Information

CVE: CVE-2004-0203

BID: 10902

OSVDB: 8407

MSFT: MS04-026

MSKB: 842436

CWE: 20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990