VDB
CVE-2003-0904
CVE-2003-0904
PUBLISHED
CVSS 6 MEDIUM
Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Services 2.0 is installed.
EPSS 15.05% · 94.7th percentile
Risk Scores
CVSS 2.0
6
EPSS Score
15.05%
94.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| microsoft | windows_server_2003 | r2 |
| microsoft | sharepoint_services | 2.0 |
| n/a | n/a | n/a |
| microsoft | exchange_server | 2003 |
Timeline
- Jan 8, 2004 CVE Published
- Feb 4, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 3, 2023 EPSS Score
- Jul 17, 2023 EPSS Score
- Sep 8, 2023 EPSS Score
- Dec 22, 2023 EPSS Score
- Feb 13, 2024 EPSS Score
References
- 9409 vdb
- VU#530660 third-party-advisory
- oval:org.mitre.oval:def:477 vdb
- 9118 vdb
- 10615 third-party-advisory
- http://www.microsoft.com/exchange/support/e2k3owa.asp url
- exchange-owa-account-access(13869) vdb
- MS04-002 vendor-advisory
- 20031114 Exchange 2003 OWA major security flaw mailing-list
- https://nvd.nist.gov/vuln/detail/CVE-2003-0904 advisory