PT-2017-18411 · Microsoft · Exchange Outlook Web Access+1

Ashar Javed + 1 · Publicado 2017-07-11 · Atualizado 2017-07-14 · CVE-2017-8560

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server versions 2010 SP3, 2013 SP3, 2013 CU16, 2016 CU5

Description The issue arises from the way Microsoft Exchange Outlook Web Access (OWA) handles web requests, allowing an elevation of privilege. This could lead to script or content injection attacks, where an attacker might trick a user into disclosing sensitive information by clicking a maliciously crafted link.

Recommendations For Microsoft Exchange Server 2010 SP3, update to a version that includes the fix for this issue. For Microsoft Exchange Server 2013 SP3, update to a version that includes the fix for this issue. For Microsoft Exchange Server 2013 CU16, update to a version that includes the fix for this issue. For Microsoft Exchange Server 2016 CU5, update to a version that includes the fix for this issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-8560

Produtos afetados

Exchange Server

Exchange Outlook Web Access

Referências · 5

• http://securityfocus.com/bid/99449 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-8560 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-8560 · Aviso do Fabricante
• http://securitytracker.com/id/1038852 · Nota
• https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8560 · Aviso do Fabricante