PT-2015-5404 · Microsoft · Exchange Server 2013+1

Published 2015-03-10 · Updated 2018-10-12 · CVE-2015-1631

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2013 SP1 and Cumulative Update 7

Description A spoofing issue exists due to the failure of Exchange Server to properly validate the meeting organizer's identity when accepting or modifying meeting requests. This could allow an attacker to schedule or modify meetings while appearing to originate from a legitimate meeting organizer.

Recommendations For Microsoft Exchange Server 2013 SP1 and Cumulative Update 7, consider implementing additional validation for meeting organizer identities to prevent spoofing until a patch is available. Restrict access to meeting scheduling and modification features to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2015-1631

Affected Products

Exchange Server

Exchange Server 2013

References · 6

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-026 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1631 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-1631 · Security Note
• http://technet.microsoft.com/security/bulletin/ms15-026 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1631 · Note
• http://securitytracker.com/id/1031900 · Note