Microsoft Outlook for Android Open to XSS Attacks (Patched)

[LASER_oneXM]

Content source

https://threatpost.com/microsoft-outlook-android-xss/145924/

A spoofing bug (CVE-2019-1105) can open the door to an email attack chain.

Microsoft has patched a vulnerability in Microsoft Outlook for Android, which opens the door to cross-site scripting (XSS) attacks.
The software giant said that CVE-2019-1105, rated “important,” is a spoofing vulnerability that exists in the way Microsoft Outlook for Android software parses specifically crafted email messages.
“An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim,” according to Microsoft’s Thursday advisory. “The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on the affected systems and run scripts in the security context of the current user.”