The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability exists when     Microsoft Exchange Outlook Web Access (OWA) fails to     properly handle web requests. An attacker who     successfully exploited this vulnerability could perform     script/content injection attacks and attempt to trick     the user into disclosing sensitive information. To     exploit the vulnerability, an attacker could send a     specially crafted email message containing a malicious     link to a user. Alternatively, an attacker could use a     chat client to social engineer a user into clicking the     malicious link. The security update addresses the     vulnerability by correcting how Microsoft Exchange     validates web requests. Note: In order to exploit this     vulnerability, a user must click a maliciously crafted     link from an attacker. (CVE-2017-8758)

  - An input sanitization issue exists with Microsoft     Exchange that could potentially result in unintended     Information Disclosure. An attacker who successfully     exploited the vulnerability could identify the existence     of RFC1918 addresses on the local network from a client     on the Internet. An attacker could use this internal     host information as part of a larger attack. To exploit     the vulnerability, an attacker could include specially     crafted tags in Calendar-related messages sent to an     Exchange server. These specially-tagged messages could     prompt the Exchange server to fetch information from     internal servers. By observing telemetry from these     requests, a client could discern properties of internal     hosts intended to be hidden from the Internet. The     update corrects the way that Exchange parses Calendar-     related messages. (CVE-2017-11761)

Detections

Analytics

Security Updates for Exchange (September 2017)

medium Nessus Plugin ID 103139

Version 1.15

Version 1.14

Version 1.15 Nov 21, 2025, 2:12 PM CVSS metrics ("CVSSv3 score" set to 6.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N") CVSSv3 score source (set to "CVE-2017-8758") Plugin Feed: 202511211412
Version 1.14 Jun 6, 2024, 8:00 PM Plugin metadata Plugin Feed: 202406062000