CVE-2003-0904
Published · Updated
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 8.2%
exploitation probability
8.2%top 5% of all CVEs
observed exploitation
nono source reports it
Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Services 2.0 is installed.
Affected products
n/a · n/aReferences
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-002http://secunia.com/advisories/10615https://exchange.xforce.ibmcloud.com/vulnerabilities/13869https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A477http://www.kb.cert.org/vuls/id/530660http://www.microsoft.com/exchange/support/e2k3owa.asphttp://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0311&L=ntbugtraq&F=P&S=&P=9281http://www.securityfocus.com/bid/9118http://www.securityfocus.com/bid/9409