CVE-2018-0924
published 2018-03-14CVE-2018-0924: Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative…
PriorityP336medium6.5CVSS 3.0
AVNACLPRNUIRSUCHINAN
EPSS
8.03%
94.5th percentile
Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 19, Microsoft Exchange Server 2013 Service Pack 1, Microsoft Exchange Server 2016 Cumulative Update 7, and Microsoft Exchange Server 2016 Cumulative Update 8 allow an information disclosure vulnerability due to how URL redirects are handled, aka "Microsoft Exchange Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0941.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft_corporation | exchange_server | — | — |
| msrc | microsoft_exchange_server_2010_service_pack_3_update_rollup_20 | — | — |
| msrc | microsoft_exchange_server_2013_cumulative_update_18 | — | — |
| msrc | microsoft_exchange_server_2013_cumulative_update_19 | — | — |
| msrc | microsoft_exchange_server_2013_service_pack_1 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_7 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_8 | — | — |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_msrc6.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x3h6-6762-5q8f: Microsoft Exchange Server 2016 Cumulative Update 7 and Microsoft Exchange Server 2016 Cumulative Update 8 allow an information disclosure vulnerabilit
ghsa_unreviewed·2022-05-13·CVSS 6.5
CVE-2018-0941 [MEDIUM] GHSA-x3h6-6762-5q8f: Microsoft Exchange Server 2016 Cumulative Update 7 and Microsoft Exchange Server 2016 Cumulative Update 8 allow an information disclosure vulnerabilit
Microsoft Exchange Server 2016 Cumulative Update 7 and Microsoft Exchange Server 2016 Cumulative Update 8 allow an information disclosure vulnerability due to how data is imported, aka "Microsoft Exchange Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0924.
GHSA
GHSA-82pv-x3j7-8x3m: Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cu
ghsa_unreviewed·2022-05-13·CVSS 5.5
CVE-2018-0924 [MEDIUM] CWE-601 GHSA-82pv-x3j7-8x3m: Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cu
Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 19, Microsoft Exchange Server 2013 Service Pack 1, Microsoft Exchange Server 2016 Cumulative Update 7, and Microsoft Exchange Server 2016 Cumulative Update 8 allow an information disclosure vulnerability due to how URL redirects are handled, aka "Microsoft Exchange Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0941.
Microsoft
Microsoft Exchange Information Disclosure Vulnerability
vendor_msrc·2018-03-13·CVSS 6.5
CVE-2018-0924 [MEDIUM] Microsoft Exchange Information Disclosure Vulnerability
Microsoft Exchange Information Disclosure Vulnerability
Description: An information disclosure vulnerability exists in the way that Microsoft Exchange Server handles URL redirects. If an impacted user is using Microsoft Exchange Outlook Web Access (OWA) Light, the vulnerability could allow an attacker to discover sensitive information that should otherwise not be disclosed, such as the URL of the user's OWA service.
To exploit the vulnerability, an attacker could embed a link in an email and send it to a victim. The attacker would then have to trick the user into clicking the link. The attacker would be unable to force the user to click the link.
The security update addresses the vulnerability by correcting how Microsoft Exchange handles URL redirects.
Microsoft Exchange Server: Microsof
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/103320http://www.securitytracker.com/id/1040521https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0924http://www.securityfocus.com/bid/103320http://www.securitytracker.com/id/1040521https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0924
2018-03-14
Published