CVE-2019-0817: Medium severity microsoft exchange server vulnerability

Published Apr 9, 2019

Updated

A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0858.

Affected Software

6 affected components

Microsoft Exchange Server=2010-sp3

Microsoft Exchange Server=2013-cumulative_update_22

Microsoft Exchange Server=2016-cumulative_update_11

Microsoft Exchange Server=2016-cumulative_update_12

Microsoft Exchange Server=2019

Microsoft Exchange Server=2019-cumulative_update_1

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0817

Event History

Apr 9, 2019

CVE Published

via MITRE·08:16 PM

Data Sourced

via MITRE·08:16 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-0817?

CVE-2019-0817 has a severity rating of important, indicating a significant risk level.

How do I fix CVE-2019-0817?

To fix CVE-2019-0817, apply the recommended security updates provided by Microsoft for the affected versions of Exchange Server.

What versions of Microsoft Exchange Server are affected by CVE-2019-0817?

CVE-2019-0817 affects Microsoft Exchange Server 2010 SP3, 2013 cumulative update 22, 2016 cumulative update 11 and 12, and 2019.

What types of attacks does CVE-2019-0817 enable?

CVE-2019-0817 can potentially allow an attacker to spoof web requests in Microsoft Exchange Server.

Is there a workaround for CVE-2019-0817?

Microsoft advises applying the security updates as the primary resolution, with limited mitigations for CVE-2019-0817.