Information disclosure in Microsoft Exchange_server
CVE-2003-0904
Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an au…
Vulnerability class: Information Disclosure
EPSS: 0.082 (94.2th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Exchange_server — versions 2003
- Microsoft Sharepoint_services — versions 2.0
- Microsoft Windows_server_2003 — versions r2
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- cve@mitre.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)
- cve@mitre.org (x_refsource_OVAL, signature, Third Party Advisory, vdb-entry)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_MS, vendor-advisory, Patch, Vendor Advisory)
- cve@mitre.org (mailing-list, Third Party Advisory, x_refsource_NTBUGTRAQ)
Frequently asked questions
- What is CVE-2003-0904?
- CVE-2003-0904 is a vulnerability in Microsoft Exchange_server, classified under Information Disclosure. Published 2004-01-20.
- Is CVE-2003-0904 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.