Microsoft Outlook Web Access

[Mobo]

Donnie Werner has reported a weakness in Microsoft Outlook Web Access (OWA), which potentially can be exploited by malicious people to conduct phishing attacks.

The weakness is caused due to a design error in the way OWA uses an unverified user supplied argument to redirect a user after successful authentication. This can e.g. be exploited by tricking a user into following a link from a HTML document to the trusted login page with a malicious "url" parameter. After successful authentication, the user will be redirected to the untrusted (fake) site.

Solution:
Do not follow links from untrusted sites or emails.