CVEvulnerability
CVE-2003-0904
6.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2004-01-20
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-200
Description
Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Services 2.0 is installed.
Affected configurations
• microsoft exchange server 2003
• microsoft sharepoint services 2.0
• microsoft windows server 2003
• microsoft windows server 2003 r2
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://secunia.com/advisories/10615 Third Party Advisory
- http://www.kb.cert.org/vuls/id/530660 Third Party Advisory, US Government Resource
- http://www.microsoft.com/exchange/support/e2k3owa.asp Patch, Vendor Advisory
- http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0311&L=ntbugtraq&F=P&S=&P=9281 Third Party Advisory
- http://www.securityfocus.com/bid/9118 Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/9409 Third Party Advisory, VDB Entry
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-002 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/13869 Third Party Advisory, VDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A477 Third Party Advisory
- http://secunia.com/advisories/10615 Third Party Advisory
- http://www.kb.cert.org/vuls/id/530660 Third Party Advisory, US Government Resource
- http://www.microsoft.com/exchange/support/e2k3owa.asp Patch, Vendor Advisory
- http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0311&L=ntbugtraq&F=P&S=&P=9281 Third Party Advisory
- http://www.securityfocus.com/bid/9118 Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/9409 Third Party Advisory, VDB Entry
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-002 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/13869 Third Party Advisory, VDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A477 Third Party Advisory