CVE-2003-0904

Microsoft Exchange 2003 - Unauthorized Mailbox Access via NTLM Authentication

Title source: llm
STIX 2.1

Description

Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Services 2.0 is installed.

References (9)

Core 9
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/9409
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/530660
Third Party Advisory vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A477
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/9118
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/10615
Patch, Vendor Advisory x_refsource_confirm
http://www.microsoft.com/exchange/support/e2k3owa.asp
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/13869
Patch, Vendor Advisory vendor-advisory x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-002
Third Party Advisory mailing-list x_refsource_ntbugtraq
http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0311&L=ntbugtraq&F=P&S=&P=9281

Scores

EPSS 0.0816
EPSS Percentile 94.2%

Details

CWE
CWE-200
Status published
Products (4)
microsoft/exchange_server 2003
microsoft/sharepoint_services 2.0
microsoft/windows_server_2003 (4 CPE variants)
microsoft/windows_server_2003 r2
Published Jan 20, 2004
Tracked Since Feb 18, 2026