Vulnerability Name:

CVE-2016-0032 (CCN-109433)

Assigned:2015-12-04
Published:2016-01-12
Updated:2020-04-09
Summary:Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."
CVSS v3 Severity:6.1 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.3 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
5.4 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
4.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
5.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2016-0032

Source: CCN
Type: Microsoft Security Bulletin MS16-004
Security Update for Microsoft Exchange Server to Address Spoofing (3124557)

Source: CCN
Type: Microsoft Security Bulletin MS16-015
Security Update for Microsoft Office to Address Remote Code Execution (3134226)

Source: CCN
Type: Microsoft Security Bulletin MS16-029
Security Update for Microsoft Office to Address Remote Code Execution (3141806)

Source: CCN
Type: Microsoft Security Bulletin MS16-042
Security Update for Microsoft Office (3148775)

Source: CCN
Type: Microsoft Security Bulletin MS16-054
Security Update for Microsoft Office (3155544)

Source: CCN
Type: Microsoft Security Bulletin MS16-070
Security Update for Office (3163610)

Source: CCN
Type: Microsoft Security Bulletin MS16-088
Security Updates for Office (3170008)

Source: CCN
Type: Microsoft Security Bulletin MS16-099
Security Update for Office (3177451)

Source: CCN
Type: Microsoft Security Bulletin MS16-107
Security Update for Microsoft Office (3185852)

Source: CCN
Type: Microsoft Security Bulletin MS16-121
Security Update for Microsoft Office (3194063)

Source: CCN
Type: Microsoft Security Bulletin MS16-133
Security Update for Microsoft Office (3199168)

Source: CCN
Type: Microsoft Security Bulletin MS16-148
Security Update for Microsoft Office (3204068)

Source: CCN
Type: Microsoft Security Bulletin MS17-002
Security Update for Microsoft Office (3214291)

Source: CCN
Type: Microsoft Security Bulletin MS17-013
Security Update for Microsoft Graphics Component (4013075)

Source: CCN
Type: Microsoft Security Bulletin MS17-014
Security Update for Microsoft Office (4013241)

Source: BID
Type: Third Party Advisory, VDB Entry
79884

Source: CCN
Type: BID-79884
Microsoft Exchange Server CVE-2016-0032 Spoofing Vulnerability

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1034647

Source: MS
Type: Patch, Vendor Advisory
MS16-010

Source: XF
Type: UNKNOWN
ms-exchange-cve20160032-spoofing(109433)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:exchange_server:2013:cumulative_update_10:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2013:cumulative_update_11:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2016:-:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2013:cumulative_update_10:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2013:cumulative_update_11:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2016:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    microsoft exchange server 2013 cumulative_update_10
    microsoft exchange server 2013 cumulative_update_11
    microsoft exchange server 2013 sp1
    microsoft exchange server 2016 -
    microsoft exchange server 2013 sp1
    microsoft exchange server 2013 cumulative_update_10
    microsoft exchange server 2013 cumulative_update_11
    microsoft exchange server 2016