Microsoft Exchange Server CVE-2017-8621 Open Redirection Vulnerability

Bugtraq ID:	99533
Class:	Design Error
CVE:	CVE-2017-8621
Remote:	Yes
Local:	No
Published:	Jul 11 2017 12:00AM
Updated:	Jul 11 2017 12:00AM
Credit:	Microsoft
Vulnerable:	Microsoft Exchange Server 2016 Cumulative Update 5 Microsoft Exchange Server 2013 SP1 0 Microsoft Exchange Server 2013 Cumulative Update 16 Microsoft Exchange Server 2010 SP3
Not Vulnerable:

Microsoft Exchange Server CVE-2017-8621 Open Redirection Vulnerability

Microsoft .NET Framework is prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input.

An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.

Microsoft Exchange Server CVE-2017-8621 Open Redirection Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Exchange Server CVE-2017-8621 Open Redirection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Microsoft Exchange Server CVE-2017-8621 Open Redirection Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• CVE-2017-8621 | Microsoft Exchange Open Redirect Vulnerability (Microsoft)