Microsoft Exchange Server CVE-2015-1771 Cross Site Request Forgery Vulnerability

Bugtraq ID:	75011
Class:	Input Validation Error
CVE:	CVE-2015-1771
Remote:	Yes
Local:	No
Published:	Jun 09 2015 12:00AM
Updated:	Jun 09 2015 12:00AM
Credit:	Microsoft
Vulnerable:
Not Vulnerable:

Microsoft Exchange Server CVE-2015-1771 Cross Site Request Forgery Vulnerability

Microsoft Exchange Server is prone to a cross-site request-forgery vulnerability.

An attacker can exploit this issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.

Microsoft Exchange Server CVE-2015-1771 Cross Site Request Forgery Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.

Microsoft Exchange Server CVE-2015-1771 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Microsoft Exchange Server 2013 Cumulative Update 8 0

• Microsoft Security Update For Exchange Server 2013 CU8 (KB3062157)
  https://www.microsoft.com/downloads/details.aspx?FamilyID=210f8d09-35a 0-46ab-9696-846af41364f3

Microsoft Exchange Server 2013 SP1 0

• Microsoft Security Update For Exchange Server 2013 SP1 (KB3062157)
  https://www.microsoft.com/downloads/details.aspx?FamilyID=d2ff4e07-25a 2-4874-b62f-8891156d274a