PT-2015-5404 · Microsoft · Exchange Server 2013+1

Publicado 2015-03-10 · Atualizado 2018-10-12 · CVE-2015-1631

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2013 SP1 and Cumulative Update 7

Description A spoofing issue exists due to the failure of Exchange Server to properly validate the meeting organizer's identity when accepting or modifying meeting requests. This could allow an attacker to schedule or modify meetings while appearing to originate from a legitimate meeting organizer.

Recommendations For Microsoft Exchange Server 2013 SP1 and Cumulative Update 7, consider implementing additional validation for meeting organizer identities to prevent spoofing until a patch is available. Restrict access to meeting scheduling and modification features to minimize the risk of exploitation.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2015-1631

Produtos afetados

Exchange Server

Exchange Server 2013

Referências · 6

• http://technet.microsoft.com/security/bulletin/ms15-026 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1631 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-026 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1631 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2015-1631 · Nota de Segurança
• http://securitytracker.com/id/1031900 · Nota