CVE-2017-0110: XSS

Published Mar 17, 2017

Updated

Cross-site scripting (XSS) vulnerability in Microsoft Exchange Outlook Web Access (OWA) allows remote attackers to inject arbitrary web script or HTML via a crafted email or chat client, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability."

Affected Software

3 affected components

Microsoft Exchange Server=2013-cumulative_update_14

Microsoft Exchange Server=2013-cumulative_update_3

Microsoft Exchange Server=2013-sp1

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0110

Event History

Mar 17, 2017

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-0110?

CVE-2017-0110 is classified as a moderate severity vulnerability due to its potential impact on Microsoft Exchange users.

How do I fix CVE-2017-0110?

To fix CVE-2017-0110, apply the relevant security updates provided by Microsoft for affected Exchange Server versions.

Which versions of Microsoft Exchange are affected by CVE-2017-0110?

CVE-2017-0110 affects Microsoft Exchange Server 2013 cumulative updates 3 and 14, as well as Service Pack 1.

What type of vulnerability is CVE-2017-0110?

CVE-2017-0110 is a cross-site scripting (XSS) vulnerability that allows the injection of arbitrary web script or HTML.

What are the potential consequences of CVE-2017-0110?

The exploitation of CVE-2017-0110 may allow remote attackers to gain unauthorized access and impersonate users.