CVE-2019-0588

An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka "Microsoft Exchange Information Disclosure Vulnerability." This affects Microsoft Exchange Server.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/106437	Third Party Advisory VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0588	Patch Vendor Advisory
http://www.securityfocus.com/bid/106437	Third Party Advisory VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0588	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup25::::::
	cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_21::::::
	cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10::::::
	cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11::::::
	cpe:2.3:a:microsoft:exchange_server:2019:-::::::

History

No history.

Information

Published : 2019-01-08 21:29

Updated : 2024-11-21 04:16

NVD link : CVE-2019-0588

Mitre link : CVE-2019-0588

CVE.ORG link : CVE-2019-0588

JSON object : View

Products Affected

microsoft

exchange_server

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2019-0588", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2019-01-08T21:29:02.237", "references": [{"url": "http://www.securityfocus.com/bid/106437", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secure@microsoft.com"}, {"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0588", "tags": ["Patch", "Vendor Advisory"], "source": "secure@microsoft.com"}, {"url": "http://www.securityfocus.com/bid/106437", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0588", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka \"Microsoft Exchange Information Disclosure Vulnerability.\" This affects Microsoft Exchange Server."}, {"lang": "es", "value": "Existe una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n cuando la API de Microsoft Exchange PowerShell concede m\u00e1s permisos de lo que pretend\u00eda a los \"colaboradores de calendario\", tambi\u00e9n conocida como \"Microsoft Exchange Information Disclosure Vulnerability\". Esto afecta a Microsoft Exchange Server."}], "lastModified": "2024-11-21T04:16:54.863", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup25:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74A0934B-C3FF-48C0-8B57-4046C05A2C33"}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_21:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B560F8FD-068E-4A16-A37F-A62DCE88FCF2"}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63E362CB-CF75-4B7E-A4B1-D6D84AFCBB68"}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BE04790-85A2-4078-88CE-1787BC5172E7"}, {"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40D8A6DB-9225-4A3F-AD76-192F6CCCF002"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}