1. CVE-Search
  2. CVE-2018-16793
ID CVE-2018-16793
Summary Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username parameter in /owa/auth/logon.aspx in the OWA (Outlook Web Access) login page.
References
Vulnerable Configurations
  • cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup1:*:*:*:*:*:*
    cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup10:*:*:*:*:*:*
    cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup10:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup11:*:*:*:*:*:*
    cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup11:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup12:*:*:*:*:*:*
    cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup12:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup13:*:*:*:*:*:*
    cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup13:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup14:*:*:*:*:*:*
    cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup14:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup15:*:*:*:*:*:*
    cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup15:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup16:*:*:*:*:*:*
    cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup16:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup17:*:*:*:*:*:*
    cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup17:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup18:*:*:*:*:*:*
    cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup18:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup2:*:*:*:*:*:*
    cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup2:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup3:*:*:*:*:*:*
    cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup4:*:*:*:*:*:*
    cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup4:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup5:*:*:*:*:*:*
    cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup5:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup6:*:*:*:*:*:*
    cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup6:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup7:*:*:*:*:*:*
    cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup7:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup8:*:*:*:*:*:*
    cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup8:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup9:*:*:*:*:*:*
    cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup9:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 20-11-2018 - 21:06)
Impact:
Exploitability:
CWE CWE-918
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:P/A:N
refmap via4
bid 105386
bugtraq 20180917 Disclose SSRF Vulnerability
fulldisc 20180917 Disclose SSRF Vulnerability
misc http://packetstormsecurity.com/files/149411/Rollup-18-For-Microsoft-Exchange-Server-2010-SP3-Server-Side-Request-Forgery.html
Last major update 20-11-2018 - 21:06
Published 21-09-2018 - 16:29
Last modified 20-11-2018 - 21:06
Back to Top