Information disclosure in Microsoft Exchange Server
CVE-2003-0904
Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Services 2.0 is installed.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v2 metric
CVSS v2 base score 6.0 (Medium). Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.082 (94.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 94.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.082 · newest: 0.082 · change: 0.000
Affected products
- Microsoft Exchange Server — versions 2003
- Microsoft Sharepoint Services — versions 2.0
- Microsoft Windows Server 2003 — versions r2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.securityfocus.com/bid/9409 (VDB Entry, Third Party Advisory, vdb-entry)
- www.kb.cert.org/vuls/id/530660 (US Government Resource, Third Party Advisory, third-party-advisory)
- oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:477 (signature, Third Party Advisory, vdb-entry)
- www.securityfocus.com/bid/9118 (VDB Entry, Third Party Advisory, vdb-entry)
- secunia.com/advisories/10615 (Third Party Advisory, third-party-advisory)
- www.microsoft.com/exchange/support/e2k3owa.asp (Patch, Vendor Advisory)
- exchange.xforce.ibmcloud.com/vulnerabilities/13869 (VDB Entry, Third Party Advisory, vdb-entry)
- docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-002 (vendor-advisory, Patch, Vendor Advisory)
- www.ntbugtraq.com/default.asp (mailing-list, Third Party Advisory)
Frequently asked questions
- What is CVE-2003-0904?
- CVE-2003-0904 is a vulnerability in Microsoft Exchange Server, classified under Information Disclosure. Published 2004-01-20.
- Is CVE-2003-0904 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.