CVE-2010-2091 — Microsoft Outlook Web Access (OWA) 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is used, does not properly handle the id parameter in a Folder IPF.Note action to the default URI, which might allow remote attackers to obtain sensitive information or conduct cross-site scripting (XSS) attacks via an invalid value

Back Back to CVE browser

MEDIUM

Microsoft Outlook Web Access (OWA) 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is used, does not properly handle the id parameter in a Folder IPF.Note action to the default URI, which might allow remote attackers to obtain sensitive information or conduct cross-site scripting (XSS) attacks via an invalid value

Published May 27, 2010

4.3

MEDIUM

CVSS 2.0

EPSS 17.94%

Description

Microsoft Outlook Web Access (OWA) 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is used, does not properly handle the id parameter in a Folder IPF.Note action to the default URI, which might allow remote attackers to obtain sensitive information or conduct cross-site scripting (XSS) attacks via an invalid value.

Affected products

Remediation

No remediation recorded yet.

Metrics

17.94% 0.17939

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.17939

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (22 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	17.94% (0.17939)	97.10th	v5 (v2026.06.15)
Jun 15, 2026	17.94% (0.17939)	96.80th	v5 (v2026.06.15)
Dec 28, 2025	4.46% (0.04459)	88.70th	v4 (v2025.03.14)
Dec 27, 2025	5.71% (0.05708)	90.18th	v4 (v2025.03.14)
Oct 28, 2025	4.08% (0.04083)	88.05th	v4 (v2025.03.14)
Oct 27, 2025	5.71% (0.05708)	90.02th	v4 (v2025.03.14)
Oct 1, 2025	4.08% (0.04083)	88.14th	v4 (v2025.03.14)
Jul 30, 2025	5.71% (0.05708)	90.06th	v4 (v2025.03.14)
Mar 30, 2025	4.46% (0.04459)	88.03th	v4 (v2025.03.14)
Mar 29, 2025	1.91% (0.01909)	72.30th	v4 (v2025.03.14)
Mar 19, 2025	4.46% (0.04459)	87.72th	v4 (v2025.03.14)
Mar 17, 2025	3.33% (0.03333)	86.45th	v4 (v2025.03.14)
Dec 12, 2024	0.92% (0.00915)	83.54th	v3 (v2023.03.01)
Jul 14, 2024	1.00% (0.00995)	83.76th	v3 (v2023.03.01)
Apr 14, 2024	0.84% (0.00836)	81.80th	v3 (v2023.03.01)
Jan 18, 2024	1.06% (0.01058)	82.50th	v3 (v2023.03.01)
Mar 7, 2023	0.89% (0.00888)	80.11th	v3 (v2023.03.01)
Mar 6, 2023	12.04% (0.12037)	95.17th	v2 (v2022.01.01)
Feb 15, 2023	12.04% (0.12037)	95.02th	v2 (v2022.01.01)
Oct 3, 2022	16.02% (0.16017)	95.93th	v2 (v2022.01.01)
Apr 1, 2022	17.12% (0.17116)	95.86th	v2 (v2022.01.01)
Feb 4, 2022	17.12% (0.17116)	93.05th	v2 (v2022.01.01)

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

http://www.exploit-db.com/exploits/12728
exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry
http://www.securityfocus.com/archive/1/511401/100/0/threaded
mailing-listx_refsource_BUGTRAQThird Party AdvisoryVDB Entry
http://www.securityfocus.com/archive/1/511416/100/0/threaded
mailing-listx_refsource_BUGTRAQThird Party AdvisoryVDB Entry
http://www.securityfocus.com/archive/1/511448/100/0/threaded
mailing-listx_refsource_BUGTRAQThird Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/58835
vdb-entryx_refsource_XFVDB Entry

Link	Providers	Tags
http://www.exploit-db.com/exploits/12728		exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry
http://www.securityfocus.com/archive/1/511401/100/0/threaded		mailing-listx_refsource_BUGTRAQThird Party AdvisoryVDB Entry
http://www.securityfocus.com/archive/1/511416/100/0/threaded		mailing-listx_refsource_BUGTRAQThird Party AdvisoryVDB Entry
http://www.securityfocus.com/archive/1/511448/100/0/threaded		mailing-listx_refsource_BUGTRAQThird Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/58835		vdb-entryx_refsource_XFVDB Entry