PT-2018-9155 · Microsoft · Exchange Server 2016+4

Richard Shupak · Publicado 2018-03-13 · Atualizado 2020-08-24 · CVE-2018-0924

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server 2010 version 14.3.452.0 (Service Pack 3 Update Rollup 20) Microsoft Exchange Server 2013 versions 15.0.1395.4 through 15.0.1473.3 Microsoft Exchange Server 2016 versions 15.1.1034.26 through 15.1.1068.10

Description: An information disclosure issue exists due to how URL redirects are handled. This could allow an attacker to discover sensitive information, such as the URL of the user's Outlook Web Access (OWA) service, if the impacted user is using Microsoft Exchange Outlook Web Access (OWA) Light.

Recommendations: For Microsoft Exchange Server 2010 version 14.3.452.0, update to a newer version to mitigate the risk. For Microsoft Exchange Server 2013 versions 15.0.1395.4 through 15.0.1473.3, update to a newer version to mitigate the risk. For Microsoft Exchange Server 2016 versions 15.1.1034.26 through 15.1.1068.10, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the OWA Light service until a patch is available.

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2018-0924

Produtos afetados

Exchange Server

Exchange Server 2010

Exchange Server 2013

Exchange Server 2016

Outlook Web Access

Referências · 5

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0924 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-0924 · Aviso do Fabricante
• http://securitytracker.com/id/1040521 · Nota
• http://securityfocus.com/bid/103320 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-0924 · Nota de Segurança