CVE-2019-0588: Medium severity microsoft exchange server vulnerability

Published Jan 8, 2019

Updated

An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka "Microsoft Exchange Information Disclosure Vulnerability." This affects Microsoft Exchange Server.

Affected Software

5 affected components

Microsoft Exchange Server=2010-sp3_rollup25

Microsoft Exchange Server=2013-cumulative_update_21

Microsoft Exchange Server=2016-cumulative_update_10

Microsoft Exchange Server=2016-cumulative_update_11

Microsoft Exchange Server=2019

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0588

Event History

Jan 8, 2019

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-0588?

CVE-2019-0588 is classified as a medium severity vulnerability affecting Microsoft Exchange.

How do I fix CVE-2019-0588?

To fix CVE-2019-0588, apply the recommended security updates provided by Microsoft for your specific version of Exchange Server.

What versions of Microsoft Exchange are affected by CVE-2019-0588?

CVE-2019-0588 affects Microsoft Exchange Server 2010, 2013, 2016, and 2019 with specific updates.

What type of vulnerability is CVE-2019-0588?

CVE-2019-0588 is an information disclosure vulnerability related to excessive permissions in the PowerShell API.

Can CVE-2019-0588 lead to unauthorized access?

Yes, CVE-2019-0588 may allow unauthorized users to gain more view permissions than intended for calendar data.