PT-2017-12314 · Microsoft · Exchange Server 2016+2

Published 2017-12-12 · Updated 2018-01-02 · CVE-2017-11932

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2016 versions CU5

Description A spoofing issue exists due to the way Outlook Web Access (OWA) validates web requests. This could allow an attacker to perform script or content injection attacks and attempt to trick the user into disclosing sensitive information. The attacker could also redirect the user to a malicious website that could spoof content or be used to chain an attack with other vulnerabilities in web services.

Recommendations For Microsoft Exchange Server 2016 version CU5, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-11932

Affected Products

Exchange Server

Exchange Server 2016

Outlook Web Access

References · 5

• https://osv.dev/vulnerability/CVE-2017-11932 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11932 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11932 · Vendor Advisory
• http://securityfocus.com/bid/102060 · Note
• http://securitytracker.com/id/1039996 · Note