PT-2019-1780 · Microsoft · Outlook Web Access+1

Publicado 2019-04-09 · Atualizado 2020-04-09 · CVE-2019-0817

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server (affected versions not specified)

Description A spoofing issue exists due to the improper handling of web requests by Outlook Web Access (OWA) in Microsoft Exchange Server. This could allow a remote attacker to impact the confidentiality and integrity of protected information using a specially crafted message. The attacker could perform script or content injection attacks, trick the user into disclosing sensitive information, or redirect the user to a malicious website that could spoof content. The issue could also be used to chain an attack with other vulnerabilities in web services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-19

Identificadores relacionados

BDU:2019-01432

CVE-2019-0817

Produtos afetados

Exchange Server

Outlook Web Access

Referências · 4

• https://bdu.fstec.ru/vul/2019-01432 · Nota de Segurança
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0817 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-0817 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-0817 · Aviso do Fabricante