CVE-2016-0138

MEDIUM

Microsoft Exchange Server - Information Disclosure

Title source: rule

Description

Microsoft Exchange Server 2007 SP3, 2010 SP3, 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 misparses e-mail messages, which allows remote authenticated users to obtain sensitive Outlook application information by leveraging the Send As right, aka "Microsoft Exchange Information Disclosure Vulnerability."

References (3)

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1036778

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/92806

[Vendor Advisory] https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-108

Scores

CVSS v3 4.3

EPSS 0.1399

EPSS Percentile 94.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Classification

CWE

CWE-200

Status published

Affected Products (8)

microsoft/exchange_server

n/a/n/a

Timeline

Published Sep 14, 2016

Tracked Since Feb 18, 2026