PT-2018-9163 · Microsoft · Exchange Server 2016+2

Cameron Vincent · Published 2018-03-13 · Updated 2020-08-24 · CVE-2018-0941

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server 2016 versions Cumulative Update 7 through Cumulative Update 8

Description: An information disclosure issue exists due to how data is imported. This could allow an attacker to discover sensitive information that should otherwise not be disclosed, particularly if the impacted user is using Microsoft Exchange Outlook Web Access (OWA).

Recommendations: For Microsoft Exchange Server 2016 Cumulative Update 7, update to a version that fixes the information disclosure vulnerability. For Microsoft Exchange Server 2016 Cumulative Update 8, update to a version that fixes the information disclosure vulnerability.

Fix

Related Identifiers

CVE-2018-0941

Affected Products

Exchange Server

Exchange Outlook Web Access

Exchange Server 2016

References · 5

• https://osv.dev/vulnerability/CVE-2018-0941 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0941 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0941 · Security Note
• http://securityfocus.com/bid/103318 · Note
• http://securitytracker.com/id/1040521 · Note