title: Microsoft Exchange Information Disclosure Vulnerability
description: <p>An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user.</p>
<p>To exploit the vulnerability, an attacker could include specially crafted OWA messages that could be loaded, without warning or filtering, from the attacker-controlled URL. This callback vector provides an information disclosure tactic used in web beacons and other types of tracking systems.</p>
<p>The security update corrects the way that Exchange handles these token validations.</p>
problem types: Information Disclosure
affected:
{
vendor: Microsoft
product: Microsoft Exchange Server 2019 Cumulative Update 6
cpes: cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*
platforms: x64-based Systems
versions:
version: 15.02.0, lessThan: publication, versionType: custom, status: affected
}
{
vendor: Microsoft
product: Microsoft Exchange Server 2016 Cumulative Update 17
cpes: cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*
platforms: x64-based Systems
versions:
version: 15.01.0, lessThan: publication, versionType: custom, status: affected
}
{
vendor: Microsoft
product: Microsoft Exchange Server 2019 Cumulative Update 7
cpes: cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*
platforms: x64-based Systems
versions:
version: 15.02.0, lessThan: publication, versionType: custom, status: affected
}
{
vendor: Microsoft
product: Microsoft Exchange Server 2016 Cumulative Update 18
cpes: cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*
platforms: x64-based Systems
versions:
version: 15.01.0, lessThan: publication, versionType: custom, status: affected
}
{
vendor: Microsoft
product: Microsoft Exchange Server 2013 Cumulative Update 23
cpes: cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*
platforms: x64-based Systems
versions:
version: 15.00.0, lessThan: publication, versionType: custom, status: affected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C
]