Microsoft Exchange Server
CVE-2018-0924 — Microsoft Exchange Information Disclosure Vulnerability
Low
2018-03 archive
Executive Summary
An information disclosure vulnerability exists in the way that Microsoft Exchange Server handles URL redirects. If an impacted user is using Microsoft Exchange Outlook Web Access (OWA) Light, the vulnerability could allow an attacker to discover sensitive information that should otherwise not be disclosed, such as the URL of the user's OWA service. To exploit the vulnerability, an attacker could embed a link in an email and send it to a victim. The attacker would then have to trick the user into clicking the link. The attacker would be unable to force the user to click the link. The security update addresses the vulnerability by correcting how Microsoft Exchange handles URL redirects.
Overview
Low
MS Severity
Not Exploited
MS Exploit Status
Exploitation Unlikely
MS Exploit Likelihood
EPSS Score
No EPSS score available for this CVE.
View on FIRST.orgAffected Products
6 affected products
| Product | KB Article | Severity | Impact | Restart Required |
|---|---|---|---|---|
| Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20 | 4073537 (Security Update) |
Low | Information Disclosure | Maybe |
| Microsoft Exchange Server 2013 Cumulative Update 18 | 4073392 (Security Update) |
Low | Information Disclosure | Maybe |
| Microsoft Exchange Server 2013 Cumulative Update 19 | 4073392 (Security Update) |
Low | Information Disclosure | Maybe |
| Microsoft Exchange Server 2013 Service Pack 1 | 4073392 (Security Update) |
Low | Information Disclosure | Maybe |
| Microsoft Exchange Server 2016 Cumulative Update 7 | 4073392 (Security Update) |
Low | Information Disclosure | Maybe |
| Microsoft Exchange Server 2016 Cumulative Update 8 | 4073392 (Security Update) |
Low | Information Disclosure | Maybe |
Patches
2 patches
| Article | Type | Restart |
|---|---|---|
4073537 |
Security Update | Maybe |
4073392 |
Security Update | Maybe |
Known Exploits
No known exploits have been linked for this CVE yet. When available, exploit references will be sourced from public repositories and may be unverified, incomplete, or non-functional. Always review code carefully before use in any environment.
Acknowledgments
References
On This Page