Vulnerabilities > CVE-2017-8621 - Open Redirect vulnerability in Microsoft Exchange Server 2010/2013/2016
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
LOW Integrity impact
LOW Availability impact
NONE Summary
Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an open redirect vulnerability that could lead to spoofing, aka "Microsoft Exchange Open Redirect Vulnerability".
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 4 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Fake the Source of Data An adversary provides data under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or it might be an attempt by the adversary to assume the rights granted to another identity. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.
Nessus
NASL family | Windows : Microsoft Bulletins |
NASL id | SMB_NT_MS17_JUL_4018588.NASL |
description | The remote Microsoft Exchange Server is missing a security update. It is, therefore, affected by multiple vulnerabilities : - Multiple cross-site scripting (XSS) vulnerabilities exist in Microsoft Exchange Outlook Web Access (OWA) due to improper validation of user-supplied input in web requests. An unauthenticated, remote attacker can exploit these, via a specially crafted link, to execute arbitrary script code in a user |
last seen | 2020-06-01 |
modified | 2020-06-02 |
plugin id | 101522 |
published | 2017-07-13 |
reporter | This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/101522 |
title | KB4018588: Security Update for Microsoft Exchange Server |
code |
|
References
- http://www.securityfocus.com/bid/99533
- http://www.securityfocus.com/bid/99533
- http://www.securitytracker.com/id/1038852
- http://www.securitytracker.com/id/1038852
- https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8621
- https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8621