{
  "cveId": "CVE-2018-0940",
  "url": "https://patchblox.com/security/cve/CVE-2018-0940",
  "summary": "CVE-2018-0940 is fixed in 6 products on 1 platform, first by KB4073537, released March 13, 2018. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Microsoft Exchange Elevation of Privilege Vulnerability",
  "description": "\u003Cp\u003EAn elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly sanitize links presented to users. An attacker who successfully exploited this vulnerability could override the OWA interface with a fake login page and attempt to trick the user into disclosing sensitive information.\u003C/p\u003E\n\u003Cp\u003ETo exploit the vulnerability, an attacker could send a specially crafted email message containing a malicious link to a user. The user would have to click the malicious link in order to be susceptible to the vulnerability.\u003C/p\u003E\n\u003Cp\u003EThe security update addresses the vulnerability by correcting how Microsoft Exchange rewrites links presented within the body of emails.\u003C/p\u003E",
  "published": "2018-03-13T07:00:00Z",
  "severity": "Moderate",
  "epss": 0.07283,
  "epssPercentile": 0.94396,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": true,
  "exploitabilityAssessment": "Exploitation Unlikely",
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2018-0940",
  "fixes": [
    {
      "platform": "microsoft",
      "product": "Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20",
      "fixedVersion": "",
      "fix": "KB4073537",
      "url": "https://patchblox.com/security/fix/microsoft/kb4073537",
      "released": "2018-03-13T07:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Exchange Server 2013 Cumulative Update 18",
      "fixedVersion": "",
      "fix": "KB4073392",
      "url": "https://patchblox.com/security/fix/microsoft/kb4073392",
      "released": "2018-03-13T07:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Exchange Server 2013 Cumulative Update 19",
      "fixedVersion": "",
      "fix": "KB4073392",
      "url": "https://patchblox.com/security/fix/microsoft/kb4073392",
      "released": "2018-03-13T07:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Exchange Server 2013 Service Pack 1",
      "fixedVersion": "",
      "fix": "KB4073392",
      "url": "https://patchblox.com/security/fix/microsoft/kb4073392",
      "released": "2018-03-13T07:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Exchange Server 2016 Cumulative Update 7",
      "fixedVersion": "",
      "fix": "KB4073392",
      "url": "https://patchblox.com/security/fix/microsoft/kb4073392",
      "released": "2018-03-13T07:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Exchange Server 2016 Cumulative Update 8",
      "fixedVersion": "",
      "fix": "KB4073392",
      "url": "https://patchblox.com/security/fix/microsoft/kb4073392",
      "released": "2018-03-13T07:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}