{
  "cveId": "CVE-2016-0028",
  "url": "https://patchblox.com/security/cve/CVE-2016-0028",
  "summary": "CVE-2016-0028 is fixed in 5 products on 1 platform, first by KB3150501, released June 14, 2016. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Microsoft Exchange Information Disclosure Vulnerability",
  "description": "\u003Cp\u003EAn email filter bypass exists in the way that Microsoft Exchange parses HTML messages that could allow information disclosure. An attacker who successfully exploited the vulnerability could identify, fingerprint, and track a user online if the user views email messages using Outlook Web Access (OWA). An attacker could also combine this vulnerability with another one, such as a Cross-Site Request Forgery (CSRF), to amplify the attack.\u003C/p\u003E\n\u003Cp\u003ETo exploit the vulnerability, an attacker could include specially crafted image URLs in OWA messages that could be loaded, without warning or filtering, from the attacker-controlled URL. This callback vector provides an information disclosure tactic used in web beacons and other types of tracking systems.\u003C/p\u003E\n\u003Cp\u003EThe update corrects the way that Exchange parses HTML messages.\u003C/p\u003E",
  "published": "2016-06-14T12:00:00Z",
  "severity": "Important",
  "epss": 0.22554,
  "epssPercentile": 0.9772,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "exploitabilityAssessment": "Exploitation Unlikely",
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2016-0028",
  "fixes": [
    {
      "platform": "microsoft",
      "product": "Microsoft Exchange Server 2013 Cumulative Update 11",
      "fixedVersion": "",
      "fix": "KB3150501",
      "url": "https://patchblox.com/security/fix/microsoft/kb3150501",
      "released": "2016-06-14T12:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Exchange Server 2013 Cumulative Update 12",
      "fixedVersion": "",
      "fix": "KB3150501",
      "url": "https://patchblox.com/security/fix/microsoft/kb3150501",
      "released": "2016-06-14T12:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Exchange Server 2013 Service Pack 1",
      "fixedVersion": "",
      "fix": "KB3150501",
      "url": "https://patchblox.com/security/fix/microsoft/kb3150501",
      "released": "2016-06-14T12:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Exchange Server 2016",
      "fixedVersion": "",
      "fix": "KB3150501",
      "url": "https://patchblox.com/security/fix/microsoft/kb3150501",
      "released": "2016-06-14T12:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Exchange Server 2016 Cumulative Update 1",
      "fixedVersion": "",
      "fix": "KB3150501",
      "url": "https://patchblox.com/security/fix/microsoft/kb3150501",
      "released": "2016-06-14T12:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T06:34:28Z"
}