Vulnerability Name:

CVE-2018-16793 (CCN-149952)

Assigned:2018-09-17
Published:2018-09-17
Updated:2018-11-20
Summary:Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username parameter in /owa/auth/logon.aspx in the OWA (Outlook Web Access) login page.
CVSS v3 Severity:8.6 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N)
7.6 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): None
8.6 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N)
7.6 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-918
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2018-16793

Source: MISC
Type: Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/149411/Rollup-18-For-Microsoft-Exchange-Server-2010-SP3-Server-Side-Request-Forgery.html

Source: FULLDISC
Type: Exploit, Mailing List, Third Party Advisory
20180917 Disclose SSRF Vulnerability

Source: BID
Type: Third Party Advisory, VDB Entry
105386

Source: CCN
Type: BID-105386
Rollup 18 for Microsoft Exchange Server Server Side Request Forgery Security Bypass Vulnerability

Source: XF
Type: UNKNOWN
microsoft-cve201816793-ssrf(149952)

Source: BUGTRAQ
Type: Exploit, Issue Tracking, Mailing List, Third Party Advisory
20180917 Disclose SSRF Vulnerability

Source: CCN
Type: Full-Disclosure Mailing List, Mon, 17 Sep 2018 19:35:09 +0300
Disclose SSRF Vulnerability

Source: CCN
Type: Microsoft Web site
Microsoft Exchange Server 2010 SP3

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:exchange_server:2010:sp3_rollup1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2010:sp3_rollup10:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2010:sp3_rollup11:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2010:sp3_rollup12:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2010:sp3_rollup13:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2010:sp3_rollup14:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2010:sp3_rollup15:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2010:sp3_rollup16:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2010:sp3_rollup17:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2010:sp3_rollup18:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2010:sp3_rollup2:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2010:sp3_rollup3:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2010:sp3_rollup4:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2010:sp3_rollup5:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2010:sp3_rollup6:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2010:sp3_rollup7:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2010:sp3_rollup8:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2010:sp3_rollup9:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:microsoft:exchange_server:2010:sp3:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    microsoft exchange server 2010 sp3_rollup1
    microsoft exchange server 2010 sp3_rollup10
    microsoft exchange server 2010 sp3_rollup11
    microsoft exchange server 2010 sp3_rollup12
    microsoft exchange server 2010 sp3_rollup13
    microsoft exchange server 2010 sp3_rollup14
    microsoft exchange server 2010 sp3_rollup15
    microsoft exchange server 2010 sp3_rollup16
    microsoft exchange server 2010 sp3_rollup17
    microsoft exchange server 2010 sp3_rollup18
    microsoft exchange server 2010 sp3_rollup2
    microsoft exchange server 2010 sp3_rollup3
    microsoft exchange server 2010 sp3_rollup4
    microsoft exchange server 2010 sp3_rollup5
    microsoft exchange server 2010 sp3_rollup6
    microsoft exchange server 2010 sp3_rollup7
    microsoft exchange server 2010 sp3_rollup8
    microsoft exchange server 2010 sp3_rollup9
    microsoft exchange server 2010 sp3