PT-2017-18410 · Microsoft · Exchange Outlook Web Access+1

Published 2017-07-11 · Updated 2017-07-14 · CVE-2017-8559

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server versions 2010 SP3, 2013 SP3, 2013 CU16, and 2016 CU5

Description An elevation of privilege issue exists due to the way Microsoft Exchange Outlook Web Access (OWA) handles web requests. This could allow an attacker to perform script or content injection attacks, potentially tricking users into disclosing sensitive information. Exploitation requires a user to click on a maliciously crafted link.

Recommendations For Microsoft Exchange Server 2010 SP3, update to a version that includes the fix for this issue. For Microsoft Exchange Server 2013 SP3, update to a version that includes the fix for this issue. For Microsoft Exchange Server 2013 CU16, update to a version that includes the fix for this issue. For Microsoft Exchange Server 2016 CU5, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to OWA to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-8559

Affected Products

Exchange Server

Exchange Outlook Web Access

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-8559 · Security Note
• https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8559 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8559 · Vendor Advisory
• http://securityfocus.com/bid/99448 · Note
• http://securitytracker.com/id/1038852 · Note