CVE-2018-16793

Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username parameter in /owa/auth/logon.aspx in the OWA (Outlook Web Access) login page.

• CWE-918

• http://packetstormsecurity.com/files/149411/Rollup-18-For-Microsoft-Exchange-Server-2010-SP3-Server-Side-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Sep/20Exploit, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/105386Third Party Advisory, VDB Entry
• https://seclists.org/bugtraq/2018/Sep/38Exploit, Issue Tracking, Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/149411/Rollup-18-For-Microsoft-Exchange-Server-2010-SP3-Server-Side-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Sep/20Exploit, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/105386Third Party Advisory, VDB Entry
• https://seclists.org/bugtraq/2018/Sep/38Exploit, Issue Tracking, Mailing List, Third Party Advisory

Published

Sep 21, 2018

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-16786DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in …
• CVE-2018-16789libhttp/url.c in shellinabox through 2.20 has an implementat…
• CVE-2018-1679IBM Sterling B2B Integrator Standard Edition 5.2 through 5.2…5.3
• CVE-2018-16790_bson_iter_next_internal in bson-iter.c in libbson 1.12.0, a…
• CVE-2018-16791In SolarWinds SFTP/SCP Server through 2018-09-10, the config…
• CVE-2018-16792SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable …9.1
• CVE-2018-16794Microsoft ADFS 4.0 Windows Server 2016 and previous (Active …
• CVE-2018-16795OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via…8.8
• CVE-2018-16796HiScout GRC Suite before 3.1.5 allows Unrestricted Upload of…
• CVE-2018-16797A heap-based buffer overflow in PotPlayerMini.exe in PotPlay…
• CVE-2018-1680IBM Security Privileged Identity Manager Virtual Appliance 2…5.9
• CVE-2018-16802An issue was discovered in Artifex Ghostscript before 9.25. …