CVE-2019-1137: XSS

Published Jul 15, 2019

Updated

A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'.

Affected Software

41 affected components

Microsoft Exchange Server=2013

Microsoft Exchange Server=2013-cumulative_update_1

Microsoft Exchange Server=2013-cumulative_update_10

Microsoft Exchange Server=2013-cumulative_update_11

Microsoft Exchange Server=2013-cumulative_update_12

Microsoft Exchange Server=2013-cumulative_update_13

Microsoft Exchange Server=2013-cumulative_update_14

Microsoft Exchange Server=2013-cumulative_update_15

Microsoft Exchange Server=2013-cumulative_update_16

Microsoft Exchange Server=2013-cumulative_update_17

Microsoft Exchange Server=2013-cumulative_update_18

Microsoft Exchange Server=2013-cumulative_update_19

Microsoft Exchange Server=2013-cumulative_update_2

Microsoft Exchange Server=2013-cumulative_update_20

Microsoft Exchange Server=2013-cumulative_update_21

Microsoft Exchange Server=2013-cumulative_update_22

Microsoft Exchange Server=2013-cumulative_update_23

Microsoft Exchange Server=2013-cumulative_update_3

Microsoft Exchange Server=2013-cumulative_update_5

Microsoft Exchange Server=2013-cumulative_update_6

Microsoft Exchange Server=2013-cumulative_update_7

Microsoft Exchange Server=2013-cumulative_update_8

Microsoft Exchange Server=2013-cumulative_update_9

Microsoft Exchange Server=2013-sp1

Microsoft Exchange Server=2016

Microsoft Exchange Server=2016-cumulative_update_1

Microsoft Exchange Server=2016-cumulative_update_10

Microsoft Exchange Server=2016-cumulative_update_11

Microsoft Exchange Server=2016-cumulative_update_12

Microsoft Exchange Server=2016-cumulative_update_13

Microsoft Exchange Server=2016-cumulative_update_2

Microsoft Exchange Server=2016-cumulative_update_3

Microsoft Exchange Server=2016-cumulative_update_4

Microsoft Exchange Server=2016-cumulative_update_5

Microsoft Exchange Server=2016-cumulative_update_6

Microsoft Exchange Server=2016-cumulative_update_7

Microsoft Exchange Server=2016-cumulative_update_8

Microsoft Exchange Server=2016-cumulative_update_9

Microsoft Exchange Server=2019

Microsoft Exchange Server=2019-cumulative_update_1

Microsoft Exchange Server=2019-cumulative_update_2

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1137

Event History

Jul 15, 2019

CVE Published

07:15 PM

Jul 29, 2019

CVE Published

via MITRE·02:14 PM

Data Sourced

via MITRE·02:14 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-1137?

CVE-2019-1137 is classified as a critical cross-site scripting (XSS) vulnerability affecting Microsoft Exchange Server.

How do I fix CVE-2019-1137?

To remediate CVE-2019-1137, apply the latest security updates provided by Microsoft for your version of Exchange Server.

Which versions of Microsoft Exchange Server are affected by CVE-2019-1137?

CVE-2019-1137 affects Microsoft Exchange Server 2013, 2016, and 2019.

What type of vulnerability is CVE-2019-1137?

CVE-2019-1137 is a cross-site scripting (XSS) vulnerability that arises from improper sanitization of web requests.

Can CVE-2019-1137 lead to data compromise?

Yes, exploitation of CVE-2019-1137 may allow attackers to execute scripts in the context of a user's session, potentially leading to data compromise.