The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - A cross-site-scripting (XSS) vulnerability exists when     Microsoft Exchange Server does not properly sanitize a     specially crafted web request to an affected Exchange     server. An authenticated attacker could exploit the     vulnerability by sending a specially crafted request to     an affected server. The attacker who successfully     exploited the vulnerability could then perform cross-     site scripting attacks on affected systems and run     script in the security context of the current user. The     attacks could allow the attacker to read content that     the attacker is not authorized to read, use the victim's     identity to take actions on the Exchange server on     behalf of the user, such as change permissions and     delete content, and inject malicious content in the     browser of the user. The security update addresses the     vulnerability by helping to ensure that Exchange Server     properly sanitizes web requests. (CVE-2019-1137)

  - An information disclosure vulnerability exists when     Exchange allows creation of entities with Display Names     having non-printable characters. An authenticated     attacker could exploit this vulnerability by creating     entities with invalid display names, which, when added     to conversations, remain invisible. This security update     addresses the issue by validating display names upon     creation in Microsoft Exchange, and by rendering invalid     display names correctly in Microsoft Outlook clients.
    (CVE-2019-1084)

  - An elevation of privilege vulnerability exists in     Microsoft Exchange Server. An attacker who successfully     exploited this vulnerability could gain the same rights     as any other user of the Exchange server. This could     allow the attacker to perform activities such as     accessing the mailboxes of other users. Exploitation of     this vulnerability requires Exchange Web Services (EWS)     to be enabled and in use in an affected environment.
    (CVE-2019-1136)

Detections

Analytics

Security Updates for Exchange (July 2019)

high Nessus Plugin ID 126581

Version 1.9

Version 1.8

Version 1.7

Version 1.9 Feb 25, 2025, 9:14 AM CVSS metrics ("CVSSv3 score" set to 8.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSSv3 score source (changed from "manual" to none) Exploit attributes ("Exploit available" set to "False") Plugin Feed: 202502250914
Version 1.8 Feb 18, 2025, 11:54 PM Plugin metadata (CVSS 3 Change AC:H --> AC:L where needed) Plugin Feed: 202502182354
Version 1.7 Jun 6, 2024, 8:00 PM Plugin metadata Plugin Feed: 202406062000