ID de Prueba:	1.3.6.1.4.1.25623.1.0.10781
Categoría:	Web application abuses
Título:	Outlook Web anonymous access
Resumen:	It is possible to browse the information of the OWA server by accessing as an; anonymous user.
Descripción:	Summary: It is possible to browse the information of the OWA server by accessing as an anonymous user. Vulnerability Insight: Accessing as an anonymous user is possible with the following URL: http://www.example.com/exchange/root.asp?acs=anon After this access, the anonymous user can search for valid users in the OWA server and can enumerate all users by accessing the following URL: http://www.example.com/exchange/finduser/details.asp?obj=XXX (where XXX is a string of 65 hexadecimal numbers) Vulnerability Impact: Data that can be accessed by an anonymous user may include: usernames, server names, email name accounts, phone numbers, departments, office, management relationships... This information will help an attacker to make social engineering attacks with the knowledge gained. This attack can be easily automated since, even if direct access to search is not possible, you only need the cookie given on the anonymous login access. Solution: Disable anonymous access to OWA. Follow these steps: 1. In Microsoft Exchange Administrator open the Configuration container. 2. Choose Protocols, and then double-click HTTP (Web) Site Settings 3. Deselect the 'Allow anonymous users to access the anonymous public folders' check box. 4. Select the Folder Shortcuts tab. 5. Remove all folders which are allowed anonymous viewing. 6. Choose OK. 7. Remove the anonymous access from the login web pages. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2001-0660 BugTraq ID: 3301 http://www.securityfocus.com/bid/3301 Microsoft Security Bulletin: MS01-047 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-047 Microsoft Knowledge Base article: Q307195 http://support.microsoft.com/support/kb/articles/Q307/1/95.ASP XForce ISS Database: exchange-owa-obtain-addresses(7089) https://exchange.xforce.ibmcloud.com/vulnerabilities/7089
Copyright	Copyright (C) 2001 Javier Fernandez-Sanguino Pena

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.