CVE-2018-16793 : Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SS

Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username parameter in /owa/auth/logon.aspx in the OWA (Outlook Web Access) login page.

Published 2018-09-21 16:29:01

Updated 2018-11-20 21:06:53

Source MITRE

View at NVD, CVE.org

Vulnerability category: Server-side request forgery (SSRF)

Products affected by CVE-2018-16793

Microsoft » Exchange Server » Version: 2010 Update Sp3 Rollup1
cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup1:*:*:*:*:*:*
Matching versions
Microsoft » Exchange Server » Version: 2010 Update Sp3 Rollup2
cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup2:*:*:*:*:*:*
Matching versions
Microsoft » Exchange Server » Version: 2010 Update Sp3 Rollup3
cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup3:*:*:*:*:*:*
Matching versions
Microsoft » Exchange Server » Version: 2010 Update Sp3 Rollup17
cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup17:*:*:*:*:*:*
Matching versions
Microsoft » Exchange Server » Version: 2010 Update Sp3 Rollup18
cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup18:*:*:*:*:*:*
Matching versions
Microsoft » Exchange Server » Version: 2010 Update Sp3 Rollup8
cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup8:*:*:*:*:*:*
Matching versions
Microsoft » Exchange Server » Version: 2010 Update Sp3 Rollup9
cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup9:*:*:*:*:*:*
Matching versions
Microsoft » Exchange Server » Version: 2010 Update Sp3 Rollup10
cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup10:*:*:*:*:*:*
Matching versions
Microsoft » Exchange Server » Version: 2010 Update Sp3 Rollup11
cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup11:*:*:*:*:*:*
Matching versions
Microsoft » Exchange Server » Version: 2010 Update Sp3 Rollup4
cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup4:*:*:*:*:*:*
Matching versions
Microsoft » Exchange Server » Version: 2010 Update Sp3 Rollup6
cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup6:*:*:*:*:*:*
Matching versions
Microsoft » Exchange Server » Version: 2010 Update Sp3 Rollup13
cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup13:*:*:*:*:*:*
Matching versions
Microsoft » Exchange Server » Version: 2010 Update Sp3 Rollup15
cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup15:*:*:*:*:*:*
Matching versions
Microsoft » Exchange Server » Version: 2010 Update Sp3 Rollup5
cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup5:*:*:*:*:*:*
Matching versions
Microsoft » Exchange Server » Version: 2010 Update Sp3 Rollup7
cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup7:*:*:*:*:*:*
Matching versions
Microsoft » Exchange Server » Version: 2010 Update Sp3 Rollup12
cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup12:*:*:*:*:*:*
Matching versions
Microsoft » Exchange Server » Version: 2010 Update Sp3 Rollup14
cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup14:*:*:*:*:*:*
Matching versions
Microsoft » Exchange Server » Version: 2010 Update Sp3 Rollup16
cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup16:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2018-16793

Top countries where our scanners detected CVE-2018-16793

Top open port discovered on systems with this issue 10001

IPs affected by CVE-2018-16793 7,160

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2018-16793!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2018-16793

EPSS FAQ

0.52%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 77 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-16793

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
8.6	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N	3.9	4.0	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2018-16793

CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-16793

http://seclists.org/fulldisclosure/2018/Sep/20

Full Disclosure: Disclose SSRF Vulnerability
Exploit;Mailing List;Third Party Advisory
http://www.securityfocus.com/bid/105386

Rollup 18 for Microsoft Exchange Server Server Side Request Forgery Security Bypass Vulnerability
Third Party Advisory;VDB Entry
https://seclists.org/bugtraq/2018/Sep/38

Bugtraq: Disclose SSRF Vulnerability
Exploit;Issue Tracking;Mailing List;Third Party Advisory
http://packetstormsecurity.com/files/149411/Rollup-18-For-Microsoft-Exchange-Server-2010-SP3-Server-Side-Request-Forgery.html

Rollup 18 For Microsoft Exchange Server 2010 SP3 Server-Side Request Forgery ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry