Secunia

Microsoft has issued a patch to fix a vulnerability in Exchange allowing malicious people to conduct Cross Site Scripting attacks.

The problem is caused by the way "Compose New Message" handles HTML encoding. This can be exploited by sending a maliciously crafted link to inject HTML or script code to the Outlook Web Access site.

An attacker must know the hostname of the Outlook Web Access server or trick the user to click a link to launch an attack.

Solution
Microsoft has issued a patch:
Further details available in Customer Area

Provided and/or discovered by
Ory Segal, Sanctum Inc

Original Advisory
Vulnerability in Exchange Server 5.5 Outlook Web Access Could Allow Cross-Site Scripting Attack
http://www.microsoft.com/technet/security/bulletin/MS03-047.asp

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area