PT-2017-12228 · Microsoft · Exchange Server

Ck01 · Publicado 2017-09-12 · Atualizado 2017-09-21 · CVE-2017-11761

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server versions 2013 through 2016

Description The issue is related to an input sanitization problem that could lead to unintended information disclosure. An attacker who successfully exploits this could identify the existence of internal network addresses from a client on the Internet, potentially using this information as part of a larger attack.

Recommendations For Microsoft Exchange Server 2013, update to a version that includes the fix for this issue. For Microsoft Exchange Server 2016, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to sensitive network information to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-11761

Produtos afetados

Exchange Server

Referências · 5

• http://securitytracker.com/id/1039320 · Nota
• http://securityfocus.com/bid/100731 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-11761 · Nota de Segurança
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11761 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-11761 · Aviso do Fabricante