Vulnerability Details : CVE-2018-0940
Microsoft Exchange Outlook Web Access (OWA) in Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 19, Microsoft Exchange Server 2013 Service Pack 1, Microsoft Exchange Server 2016 Cumulative Update 7, and Microsoft Exchange Server 2016 Cumulative Update 8 allows an elevation of privilege vulnerability due to how links in the body of an email message are rewritten, aka "Microsoft Exchange Elevation of Privilege Vulnerability".
Vulnerability category: Gain privilege
Products affected by CVE-2018-0940
- cpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_7:*:*:*:*:*:*
- cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*
- cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_18:*:*:*:*:*:*
- cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup20:*:*:*:*:*:*
- cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_19:*:*:*:*:*:*
Threat overview for CVE-2018-0940
Top countries where our scanners detected CVE-2018-0940
Top open port discovered on systems with this issue
10001
IPs affected by CVE-2018-0940 7,160
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2018-0940!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2018-0940
0.30%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 66 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-0940
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST | |
|
6.5
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
NIST |
References for CVE-2018-0940
-
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0940
CVE-2018-0940 | Microsoft Exchange Elevation of Privilege VulnerabilityPatch;Vendor Advisory
-
http://www.securityfocus.com/bid/103323
Microsoft Exchange Server CVE-2018-0940 Remote Privilege Escalation VulnerabilityThird Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1040521
Microsoft Exchange Server Lets Remote Users Spoof the Login Page and Obtain Potentially Sensitive Information - SecurityTrackerThird Party Advisory;VDB Entry
Jump to