An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited this vulnerability could perform script/content injection attacks and attempt to trick the user into disclosing sensitive information. To exploit the vulnerability, an attacker could send a specially crafted email message containing a malicious link to a user. Alternatively, an attacker could use a chat client to social engineer a user into clicking the malicious link. The security update addresses the vulnerability by correcting how Microsoft Exchange validates web requests. Note: In order to exploit this vulnerability, a user must click a maliciously crafted link from an attacker.
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Microsoft Exchange Server 2016 Cumulative Update 23 | 15.01.0.0, 15.02.0.0, 15.02.0.0, 15.02.0.0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| microsoft | microsoft exchange server 2019 cumulative update | mitre_affected | 90% |
| microsoft | microsoft exchange server subscription edition rtm | mitre_affected | 90% |
| microsoft | exchange | cert_advisory | 90% |
Loading…
