cnvd - cnvd-2019-14452

cnvd-2019-14452

Vulnerability from cnvd

Title: Microsoft Exchange Server信息泄露漏洞（CNVD-2019-14452）

Description:

Microsoft Exchange Server是美国微软（Microsoft）公司的一套电子邮件服务程序，它提供邮件存取、储存、转发，语音邮件，邮件过滤筛选等功能。

Microsoft Exchange Server存在信息泄露漏洞，远程攻击者可利用该漏洞查看日历通常隐藏的其他详细信息。

Severity: 中

Patch Name: Microsoft Exchange Server信息泄露漏洞（CNVD-2019-14452）的补丁

Patch Description:

Microsoft Exchange Server是美国微软（Microsoft）公司的一套电子邮件服务程序，它提供邮件存取、储存、转发，语音邮件，邮件过滤筛选等功能。

Microsoft Exchange Server存在信息泄露漏洞，远程攻击者可利用该漏洞查看日历通常隐藏的其他详细信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0588

Reference: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0588

Impacted products

Name
['Microsoft Exchange Server 2019', 'Microsoft Exchange Server 2016 Cumulative Update 11', 'Microsoft Exchange Server 2016 Cumulative Update 10', 'Microsoft Exchange Server 2013 Cumulative Update 21', 'Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 25']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "106437"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-0588"
    }
  },
  "description": "Microsoft Exchange Server\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u5957\u7535\u5b50\u90ae\u4ef6\u670d\u52a1\u7a0b\u5e8f\uff0c\u5b83\u63d0\u4f9b\u90ae\u4ef6\u5b58\u53d6\u3001\u50a8\u5b58\u3001\u8f6c\u53d1\uff0c\u8bed\u97f3\u90ae\u4ef6\uff0c\u90ae\u4ef6\u8fc7\u6ee4\u7b5b\u9009\u7b49\u529f\u80fd\u3002\n\nMicrosoft Exchange Server\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u67e5\u770b\u65e5\u5386\u901a\u5e38\u9690\u85cf\u7684\u5176\u4ed6\u8be6\u7ec6\u4fe1\u606f\u3002",
  "discovererName": "Cameron Vincent",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0588",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-14452",
  "openTime": "2019-05-16",
  "patchDescription": "Microsoft Exchange Server\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u5957\u7535\u5b50\u90ae\u4ef6\u670d\u52a1\u7a0b\u5e8f\uff0c\u5b83\u63d0\u4f9b\u90ae\u4ef6\u5b58\u53d6\u3001\u50a8\u5b58\u3001\u8f6c\u53d1\uff0c\u8bed\u97f3\u90ae\u4ef6\uff0c\u90ae\u4ef6\u8fc7\u6ee4\u7b5b\u9009\u7b49\u529f\u80fd\u3002\r\n\r\nMicrosoft Exchange Server\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u67e5\u770b\u65e5\u5386\u901a\u5e38\u9690\u85cf\u7684\u5176\u4ed6\u8be6\u7ec6\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft Exchange Server\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2019-14452\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Microsoft Exchange Server 2019",
      "Microsoft Exchange Server 2016 Cumulative Update 11",
      "Microsoft Exchange Server 2016 Cumulative Update 10",
      "Microsoft Exchange Server 2013 Cumulative Update 21",
      "Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 25"
    ]
  },
  "referenceLink": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0588",
  "serverity": "\u4e2d",
  "submitTime": "2019-01-09",
  "title": "Microsoft Exchange Server\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2019-14452\uff09"
}

CVE-2019-0588 (GCVE-0-2019-0588)

Vulnerability from cvelistv5

Published

2019-01-08 21:00

Modified

2024-08-04 17:51

Severity ?

CWE

Information Disclosure

Summary

An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka "Microsoft Exchange Information Disclosure Vulnerability." This affects Microsoft Exchange Server.

References

▼	URL	Tags
	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0588	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/106437	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	Microsoft	Microsoft Exchange Server	Version: 2010 Service Pack 3 Update Rollup 25 Version: 2013 Cumulative Update 21 Version: 2016 Cumulative Update 10 Version: 2016 Cumulative Update 11 Version: 2019

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:51:27.068Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0588"
          },
          {
            "name": "106437",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106437"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Microsoft Exchange Server",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "2010 Service Pack 3 Update Rollup 25"
            },
            {
              "status": "affected",
              "version": "2013 Cumulative Update 21"
            },
            {
              "status": "affected",
              "version": "2016 Cumulative Update 10"
            },
            {
              "status": "affected",
              "version": "2016 Cumulative Update 11"
            },
            {
              "status": "affected",
              "version": "2019"
            }
          ]
        }
      ],
      "datePublic": "2019-01-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka \"Microsoft Exchange Information Disclosure Vulnerability.\" This affects Microsoft Exchange Server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-01-09T10:57:01",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0588"
        },
        {
          "name": "106437",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106437"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2019-0588",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Microsoft Exchange Server",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2010 Service Pack 3 Update Rollup 25"
                          },
                          {
                            "version_value": "2013 Cumulative Update 21"
                          },
                          {
                            "version_value": "2016 Cumulative Update 10"
                          },
                          {
                            "version_value": "2016 Cumulative Update 11"
                          },
                          {
                            "version_value": "2019"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Microsoft"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka \"Microsoft Exchange Information Disclosure Vulnerability.\" This affects Microsoft Exchange Server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information Disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0588",
              "refsource": "CONFIRM",
              "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0588"
            },
            {
              "name": "106437",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106437"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2019-0588",
    "datePublished": "2019-01-08T21:00:00",
    "dateReserved": "2018-11-26T00:00:00",
    "dateUpdated": "2024-08-04T17:51:27.068Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted