Vulnerability Details CVE-2016-0028
Outlook Web Access (OWA) in Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 and 2016 Gold and Cumulative Update 1 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, aka "Microsoft Exchange Information Disclosure Vulnerability."
Exploit prediction scoring system (EPSS) score
EPSS Score 0.214
EPSS Ranking 95.3%
CVSS Severity
CVSS v3 Score 5.5
CVSS v2 Score 4.3
References
Products affected by CVE-2016-0028
-
cpe:2.3:a:microsoft:exchange_server:2013
-
cpe:2.3:a:microsoft:exchange_server:2016
-
cpe:2.3:a:microsoft:outlook_web_access:-
-
cpe:2.3:a:microsoft:outlook_web_access:2003
-
cpe:2.3:a:microsoft:outlook_web_access:2016