Information disclosure in Microsoft Exchange Server - CVE-2016-0138
Published: September 13, 2016 / Updated: March 3, 2017
Vulnerability identifier: #VU5417
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2016-0138
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Microsoft
Affected software:
Microsoft Exchange Server
Microsoft Exchange Server
Detailed vulnerability description
The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information.
The vulnerability exists due to improper parsing of email messages. A remote attacker can send a specially crafted message using "send as" rights and gain access to confidential user information that is contained in Microsoft Outlook applications.
Successful exploitation of the vulnerability leads to information disclosure on the vulnerable system.
The vulnerability exists due to improper parsing of email messages. A remote attacker can send a specially crafted message using "send as" rights and gain access to confidential user information that is contained in Microsoft Outlook applications.
Successful exploitation of the vulnerability leads to information disclosure on the vulnerable system.
How to mitigate CVE-2016-0138
Install update from vendor's website.