Lucene search

MicrosoftCVE-2016-3379

HistorySep 14, 2016 - 10:59 a.m.

CVE-2016-3379

2016-09-1410:59:53

CWE-79

microsoft

web.nvd.nist.gov

cve-2016-3379

cross-site scripting

xss

microsoft exchange server 2016

elevation of privilege

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.024

Percentile

90.2%

JSON

Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 1 and 2 allows remote attackers to inject arbitrary web script or HTML via a meeting-invitation request, aka “Microsoft Exchange Elevation of Privilege Vulnerability.”

Affected configurations

Nvd

Node

microsoftexchange_serverMatch2016cumulative_update_1

microsoftexchange_serverMatch2016cumulative_update_2

VendorProductVersionCPE
microsoftexchange_server2016cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_1:*:*:*:*:*:*
microsoftexchange_server2016cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_2:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	exchange_server	2016	cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_1::::::
microsoft	exchange_server	2016	cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_2::::::