CVE-2018-16793

Опубликовано: 21 сент. 2018

Источник: nvd

CVSS3: 8.6

CVSS2: 5

EPSS Низкий

Описание

Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username parameter in /owa/auth/logon.aspx in the OWA (Outlook Web Access) login page.

Ссылки

http://packetstormsecurity.com/files/149411/Rollup-18-For-Microsoft-Exchange-Server-2010-SP3-Server-Side-Request-Forgery.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2018/Sep/20
Exploit
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/105386
Third Party Advisory
VDB Entry
https://seclists.org/bugtraq/2018/Sep/38
Exploit
Issue Tracking
Mailing List
Third Party Advisory
http://packetstormsecurity.com/files/149411/Rollup-18-For-Microsoft-Exchange-Server-2010-SP3-Server-Side-Request-Forgery.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2018/Sep/20
Exploit
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/105386
Third Party Advisory
VDB Entry
https://seclists.org/bugtraq/2018/Sep/38
Exploit
Issue Tracking
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup1:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup10:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup11:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup12:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup13:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup14:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup15:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup16:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup17:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup18:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup2:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup3:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup4:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup5:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup6:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup7:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup8:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup9:*:*:*:*:*:*

EPSS

Процентиль: 78%

0.01115

Низкий

8.6 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-918

Связанные уязвимости

GHSA-rghf-wr3j-2757