CVE-2018-16793 — HIGH (8.6)

Vulnerability Description

Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username parameter in /owa/auth/logon.aspx in the OWA (Outlook Web Access) login page.

CVSS Score

8.6

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Microsoft	Exchange Server	2010

Related Weaknesses (CWE)

CWE-918

References

http://packetstormsecurity.com/files/149411/Rollup-18-For-Microsoft-Exchange-SerExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2018/Sep/20ExploitMailing ListThird Party Advisory
http://www.securityfocus.com/bid/105386Third Party AdvisoryVDB Entry
https://seclists.org/bugtraq/2018/Sep/38ExploitIssue TrackingMailing List
http://packetstormsecurity.com/files/149411/Rollup-18-For-Microsoft-Exchange-SerExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2018/Sep/20ExploitMailing ListThird Party Advisory
http://www.securityfocus.com/bid/105386Third Party AdvisoryVDB Entry
https://seclists.org/bugtraq/2018/Sep/38ExploitIssue TrackingMailing List

FAQ

What is CVE-2018-16793?

CVE-2018-16793 is a vulnerability with a CVSS score of 8.6 (HIGH). Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username parameter in /owa/auth/logon.aspx in the OWA (Outlook Web Access) login page.

How severe is CVE-2018-16793?

CVE-2018-16793 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-16793?

Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Exchange Server.