PT-2017-18509 · Microsoft · Exchange Server 2016+2

Published 2017-09-12 · Updated 2022-12-26 · CVE-2017-8758

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2016

Description An elevation of privilege issue exists due to the failure of Microsoft Exchange Outlook Web Access (OWA) to properly handle web requests. This could allow an attacker to perform script or content injection attacks, potentially tricking users into disclosing sensitive information. The exploitation of this issue requires a user to click on a maliciously crafted link provided by an attacker.

Recommendations For Microsoft Exchange Server 2016, consider restricting access to OWA until a proper fix is applied, and advise users to avoid clicking on suspicious links from untrusted sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-8758

Affected Products

Exchange Server

Exchange Outlook Web Access

Exchange Server 2016

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-8758 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8758 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8758 · Vendor Advisory
• http://securitytracker.com/id/1039320 · Note
• http://securityfocus.com/bid/100723 · Note
• https://t.me/canyoupwnme/6835 · Telegram Post