PT-2019-1780 · Microsoft · Outlook Web Access+1

Published 2019-04-09 · Updated 2020-04-09 · CVE-2019-0817

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server (affected versions not specified)

Description A spoofing issue exists due to the improper handling of web requests by Outlook Web Access (OWA) in Microsoft Exchange Server. This could allow a remote attacker to impact the confidentiality and integrity of protected information using a specially crafted message. The attacker could perform script or content injection attacks, trick the user into disclosing sensitive information, or redirect the user to a malicious website that could spoof content. The issue could also be used to chain an attack with other vulnerabilities in web services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-19

Related Identifiers

BDU:2019-01432

CVE-2019-0817

Affected Products

Exchange Server

Outlook Web Access

References · 4

• https://bdu.fstec.ru/vul/2019-01432 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0817 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0817 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0817 · Vendor Advisory