Microsoft Exchange Server up to 2019 CU1 Outlook Web Access input validation

Summaryinfo

A vulnerability classified as critical was found in Microsoft Exchange Server 2013 CU22/2016 CU11/2016 CU12/2019/2019 CU1. This vulnerability affects unknown code of the component Outlook Web Access. The manipulation results in input validation. This vulnerability is cataloged as CVE-2019-0858. The attack may be launched remotely. There is no exploit available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in Microsoft Exchange Server 2013 CU22/2016 CU11/2016 CU12/2019/2019 CU1 (Groupware Software). It has been classified as critical. Affected is an unknown function of the component Outlook Web Access. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0817.

The bug was discovered 04/09/2019. The weakness was shared 04/09/2019 as confirmed security update guide (Website). The advisory is shared for download at portal.msrc.microsoft.com. The vendor cooperated in the coordination of the public release. This vulnerability is traded as CVE-2019-0858 since 11/26/2018. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The advisory points out:

A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited the vulnerability could perform script or content injection attacks, and attempt to trick the user into disclosing sensitive information. An attacker could also redirect the user to a malicious website that could spoof content or the vulnerability could be used as a pivot to chain an attack with other vulnerabilities in web services.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 50091 (Microsoft Windows Exchange Server Update for April 2019).

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The entry VDB-133198 is related to this item. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Groupware Software

Vendor

• Microsoft

Name

• Exchange Server

Version

• 2013 CU22
• 2016 CU11
• 2016 CU12
• 2019
• 2019 CU1

License

• commercial

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion