The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in the     way that Microsoft Exchange Server handles URL     redirects. If an impacted user is using Microsoft     Exchange Outlook Web Access (OWA) Light, the     vulnerability could allow an attacker to discover     sensitive information that should otherwise not be     disclosed, such as the URL of the user's OWA service.
    (CVE-2018-0924)

  - An information disclosure vulnerability exists in the     way that Microsoft Exchange Server handles importing     data. If an impacted user is using Microsoft Exchange     Outlook Web Access (OWA), the vulnerability could allow     an attacker to discover sensitive information that     should otherwise not be disclosed.  (CVE-2018-0941)

  - An elevation of privilege vulnerability exists when     Microsoft Exchange Outlook Web Access (OWA) fails to     properly sanitize links presented to users. An attacker     who successfully exploited this vulnerability could     override the OWA interface with a fake login page and     attempt to trick the user into disclosing sensitive     information.  (CVE-2018-0940)

Detections

Analytics

Security Updates for Exchange (March 2018)

medium Nessus Plugin ID 108294

Version 1.13