CVE-2014-6336

Published: Dec 11, 2014Modified: May 6, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 does not properly validate redirection tokens, which allows remote attackers to redirect users to arbitrary web sites and spoof the origin of e-mail messages via unspecified vectors, aka "Exchange URL Redirection Vulnerability."

Affected (2)

Products: Microsoft: Exchange Server

1 product

Exchange Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Microsoft Exchange Server	Version 2013 cumulative_update_6
Microsoft Exchange Server	Version 2013 sp1

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-075

Source: secure@microsoft.com

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-075

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.