CVE-2020-0903: XSS

Published Mar 12, 2020

Updated

A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'.

Affected Software

4 affected components

Microsoft Exchange Server=2016-cumulative_update_14

Microsoft Exchange Server=2016-cumulative_update_15

Microsoft Exchange Server=2019-cumulative_update_3

Microsoft Exchange Server=2019-cumulative_update_4

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0903

Event History

Mar 12, 2020

CVE Published

via MITRE·03:48 PM

Data Sourced

via MITRE·03:48 PM

DescriptionWeakness

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2020-0903?

CVE-2020-0903 is classified as a critical vulnerability due to its potential for exploitation through cross-site scripting.

How do I fix CVE-2020-0903?

To fix CVE-2020-0903, apply the latest cumulative updates for Microsoft Exchange Server 2016 or 2019 as specified in Microsoft security guidance.

What types of Microsoft Exchange Server are affected by CVE-2020-0903?

CVE-2020-0903 affects Microsoft Exchange Server 2016 (cumulative updates 14 and 15) and Exchange Server 2019 (cumulative updates 3 and 4).

Can CVE-2020-0903 be exploited remotely?

Yes, CVE-2020-0903 can be exploited remotely as it involves specially crafted web requests to affected Exchange servers.

What are the consequences of exploiting CVE-2020-0903?

Exploitation of CVE-2020-0903 can lead to unauthorized access to user accounts and allow attackers to execute arbitrary code in the context of the affected user.