PT-2017-18441 · Microsoft · Exchange Server

Publicado 2017-07-11 · Atualizado 2017-07-17 · CVE-2017-8621

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server versions 2010 SP3 through 2016 CU5

Description An open redirect issue exists that could lead to spoofing. An attacker could exploit this by sending a specially crafted URL link, convincing an authenticated user to click it, and then redirecting the user's browser session to a malicious site impersonating a legitimate website. This could potentially allow the attacker to acquire sensitive information, such as the user's credentials.

Recommendations For Microsoft Exchange Server 2010 SP3, update to a version that includes the fix for this issue. For Microsoft Exchange Server 2013 SP3 and CU16, update to a version that includes the fix for this issue. For Microsoft Exchange Server 2016 CU5, update to a version that includes the fix for this issue.

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2017-8621

Produtos afetados

Exchange Server

Referências · 5

• https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8621 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-8621 · Aviso do Fabricante
• http://securityfocus.com/bid/99533 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-8621 · Nota de Segurança
• http://securitytracker.com/id/1038852 · Nota