CVE-2015-1764: SSRF

Published Jun 10, 2015

Updated

The web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allow remote attackers to bypass the Same Origin Policy and send HTTP traffic to intranet servers via a crafted request, related to a Server-Side Request Forgery (SSRF) issue, aka "Exchange Server-Side Request Forgery Vulnerability."

Affected Software

2 affected components

Microsoft Exchange Server=2013-cumulative_update_8

Microsoft Exchange Server=2013-sp1

Event History

Jun 10, 2015

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-1764?

CVE-2015-1764 has a severity rating of important, indicating a significant risk to affected systems.

How do I fix CVE-2015-1764?

To fix CVE-2015-1764, apply the appropriate security updates provided by Microsoft for Exchange Server 2013 SP1 and Cumulative Update 8.

What systems are affected by CVE-2015-1764?

CVE-2015-1764 affects Microsoft Exchange Server 2013 SP1 and its Cumulative Update 8.

What type of vulnerability is CVE-2015-1764?

CVE-2015-1764 is classified as a Server-Side Request Forgery (SSRF) vulnerability.

What can an attacker do with CVE-2015-1764?

An attacker can use CVE-2015-1764 to bypass the Same Origin Policy and send HTTP requests to intranet servers.