PT-2018-18465 · Microsoft · Exchange Outlook Web Access+1

Published 2018-05-08 · Updated 2019-10-03 · CVE-2018-8159

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server (affected versions not specified)

Description An issue exists where Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests. This could allow an attacker to perform script or content injection attacks and potentially trick users into disclosing sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-8159

Affected Products

Exchange Server

Exchange Outlook Web Access

References · 5

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8159 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8159 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8159 · Security Note
• http://securitytracker.com/id/1040850 · Note
• http://securityfocus.com/bid/104056 · Note