CVE-2017-0110

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in Microsoft Exchange Outlook Web Access (OWA) allows remote attackers to inject arbitrary web script or HTML via a crafted email or chat client, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability."

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Microsoft Corporation	Exchange Server	Exchange Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Service Pack 1, Microsoft Exchange Server Cumulative Update 14, and Microsoft Exchange Server 2016 Cumulative Update 3

References

http://www.securityfocus.com/bid/96621Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038011Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0110Patch, Vendor Advisory
http://www.securityfocus.com/bid/96621Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038011Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0110Patch, Vendor Advisory

Timeline

Published: Mar 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017