PT-2019-1816 · Microsoft · Outlook Web Access+1

Cameron Vincent · Publicado 2019-04-09 · Atualizado 2020-08-24 · CVE-2019-0858

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server (affected versions not specified)

Description A spoofing issue exists due to improper handling of web requests by Outlook Web Access (OWA) in Microsoft Exchange Server. This could allow a remote attacker to impact the confidentiality and integrity of protected information using a specially crafted link. The attacker could perform script or content injection attacks, trick the user into disclosing sensitive information, or redirect the user to a malicious website that could spoof content. The issue could also be used to chain an attack with other vulnerabilities in web services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

XSS

Enumeração de Fraquezas

CWE-269

CWE-79

Identificadores relacionados

BDU:2019-01468

CVE-2019-0858

Produtos afetados

Exchange Server

Outlook Web Access

Referências · 5

• https://osv.dev/vulnerability/CVE-2019-0858 · Aviso do Fabricante
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0858 · Aviso do Fabricante
• https://vuldb.com/?id.133224 · Nota
• https://bdu.fstec.ru/vul/2019-01468 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-0858 · Nota de Segurança