4.3

CVE-2016-0138

Microsoft Exchange Server 2007 SP3, 2010 SP3, 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 misparses e-mail messages, which allows remote authenticated users to obtain sensitive Outlook application information by leveraging the Send As right, aka "Microsoft Exchange Information Disclosure Vulnerability."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Exchange Server Version 2007 Update sp3
Microsoft ≫ Exchange Server Version 2010 Update sp3
Microsoft ≫ Exchange Server Version 2013 Update cumulative_update_12
Microsoft ≫ Exchange Server Version 2013 Update cumulative_update_13
Microsoft ≫ Exchange Server Version 2013 Update sp1
Microsoft ≫ Exchange Server Version 2016 Update cumulative_update_1
Microsoft ≫ Exchange Server Version 2016 Update cumulative_update_2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 13.46% 0.959
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 2.8 1.4
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://www.securityfocus.com/bid/92806
http://www.securitytracker.com/id/1036778
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-108