Medium severity · published Jul 11, 2017
CVE-2017-8559
Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way…
6.1
CVSS
3.4%
EPSS
No
On KEV
Description
Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access (OWA) handles web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability". This CVE ID is unique from CVE-2017-8560.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)3.4% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Exchange Server · Microsoft
2013; 2013; 2016 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-8559
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-8559
Third Party Advisory
http://www.securityfocus.com/bid/99448
Third Party Advisory
http://www.securitytracker.com/id/1038852
Patch
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8559
More from Exchange Server
9.8
CVE-2024-21410
Microsoft Exchange Server Elevation of Privilege Vulnerability
9.1
CVE-2021-34473
Microsoft Exchange Server Remote Code Execution Vulnerability
9.1
CVE-2021-26855
Microsoft Exchange Server Remote Code Execution Vulnerability
9.0
CVE-2021-34523
Microsoft Exchange Server Elevation of Privilege Vulnerability
8.8
CVE-2023-21529
Microsoft Exchange Server Remote Code Execution Vulnerability