CVE-2018-16793

Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username parameter in /owa/auth/logon.aspx in the OWA (Outlook Web Access) login page.

Link	Resource
https://seclists.org/bugtraq/2018/Sep/38	Exploit Issue Tracking
http://seclists.org/fulldisclosure/2018/Sep/20	Exploit Mailing List
http://packetstormsecurity.com/files/149411/Rollup-18-For-Microsoft-Exchange-Server-2010-SP3-Server-Side-Request-Forgery.html	Exploit Third Party Advisory
http://www.securityfocus.com/bid/105386	Third Party Advisory VDB Entry

Configuration 1

cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup1:*:*:*:*:*:* cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup2:*:*:*:*:*:* cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup3:*:*:*:*:*:* cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup4:*:*:*:*:*:* cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup5:*:*:*:*:*:* cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup6:*:*:*:*:*:* cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup7:*:*:*:*:*:* cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup8:*:*:*:*:*:* cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup9:*:*:*:*:*:* cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup10:*:*:*:*:*:* cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup11:*:*:*:*:*:* cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup12:*:*:*:*:*:* cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup13:*:*:*:*:*:* cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup14:*:*:*:*:*:* cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup15:*:*:*:*:*:* cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup16:*:*:*:*:*:* cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup17:*:*:*:*:*:* cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup18:*:*:*:*:*:*

---

Published : 2018-09-21 04:29

Updated : 2018-11-20 09:06

---

NVD link : CVE-2018-16793

Mitre link : CVE-2018-16793

No products.

CWE-918

Server-Side Request Forgery (SSRF)