PT-2017-12314 · Microsoft · Exchange Server 2016+2

Publicado 2017-12-12 · Atualizado 2018-01-02 · CVE-2017-11932

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2016 versions CU5

Description A spoofing issue exists due to the way Outlook Web Access (OWA) validates web requests. This could allow an attacker to perform script or content injection attacks and attempt to trick the user into disclosing sensitive information. The attacker could also redirect the user to a malicious website that could spoof content or be used to chain an attack with other vulnerabilities in web services.

Recommendations For Microsoft Exchange Server 2016 version CU5, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-11932

Produtos afetados

Exchange Server

Exchange Server 2016

Outlook Web Access

Referências · 5

• http://securityfocus.com/bid/102060 · Nota
• https://osv.dev/vulnerability/CVE-2017-11932 · Aviso do Fabricante
• http://securitytracker.com/id/1039996 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-11932 · Nota de Segurança
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11932 · Aviso do Fabricante