Vulnerability CVE-2016-3378

Vulnerability CVE-2016-3378

Published: 2016-09-14

Description:

Open redirect vulnerability in Microsoft Exchange Server 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "Microsoft Exchange Open Redirect Vulnerability."

See advisories in our WLB2 database:

	Topic	Author	Date
Low	Microsoft Exchange Server / Open Redirect	hyp3rlinx	28.03.2018

Type:

CWE-20

(Improper Input Validation)

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
5.8/10	4.9/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	None

Affected software
Microsoft -> Exchange server

References:

http://www.securityfocus.com/bid/92833

http://www.securitytracker.com/id/1036778

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-108

Copyright 2024, cxsecurity.com