PT-2016-5438 · Microsoft · Exchange Server 2016+2

Publicado 2016-09-13 · Atualizado 2018-10-12 · CVE-2016-3379

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2016 versions Cumulative Update 1 through Cumulative Update 2

Description The issue allows remote attackers to inject arbitrary web script or HTML via a meeting-invitation request. An elevation of privilege vulnerability exists in the way that Microsoft Outlook handles meeting invitation requests. To exploit the issue, an attacker could send a specially crafted Outlook meeting invitation request with malicious cross-site scripting (XSS) capability to a user.

Recommendations For Microsoft Exchange Server 2016 Cumulative Update 1, update to a version that includes the fix for this issue. For Microsoft Exchange Server 2016 Cumulative Update 2, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the handling of meeting invitation requests in Microsoft Outlook until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-3379

Produtos afetados

Exchange Server

Exchange Server 2016

Outlook

Referências · 5

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-108 · Aviso do Fabricante
• http://securityfocus.com/bid/92836 · Nota
• https://osv.dev/vulnerability/CVE-2016-3379 · Aviso do Fabricante
• http://securitytracker.com/id/1036778 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-3379 · Nota de Segurança