CVE-2016-3379
published 2016-09-14CVE-2016-3379: Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 1 and 2 allows remote attackers to inject arbitrary web script or…
PriorityP432medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EPSS
8.23%
94.3th percentile
Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 1 and 2 allows remote attackers to inject arbitrary web script or HTML via a meeting-invitation request, aka "Microsoft Exchange Elevation of Privilege Vulnerability."
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | exchange_server | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_1 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_2 | — | — |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_msrc6.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qhg7-cgjg-76mg: Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 1 and 2 allows remote attackers to inject arbitrary web s
ghsa_unreviewed·2022-05-14
CVE-2016-3379 [MEDIUM] CWE-79 GHSA-qhg7-cgjg-76mg: Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 1 and 2 allows remote attackers to inject arbitrary web s
Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 1 and 2 allows remote attackers to inject arbitrary web script or HTML via a meeting-invitation request, aka "Microsoft Exchange Elevation of Privilege Vulnerability."
Microsoft
Microsoft Exchange Elevation of Privilege Vulnerability
vendor_msrc·2016-09-13·CVSS 6.1
CVE-2016-3379 [MEDIUM] Microsoft Exchange Elevation of Privilege Vulnerability
Microsoft Exchange Elevation of Privilege Vulnerability
Description: An elevation of privilege vulnerability exists in the way that Microsoft Outlook handles meeting invitation requests.
To exploit the vulnerability, an attacker could send a specially crafted Outlook meeting invitation request with malicious cross-site scripting (XSS) capability to a user.
The update addresses the vulnerability by correcting how Outlook handles meeting invitation requests.
Microsoft Office: Microsoft Office
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:N/A;DOS:N/A
Reference: https://www.microsoft.com/download/details.aspx?familyid=6b407e49-79b
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/92836http://www.securitytracker.com/id/1036778https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-108http://www.securityfocus.com/bid/92836http://www.securitytracker.com/id/1036778https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-108
2016-09-14
Published