Read the docs
TI-2019-00864 Aliases CVE-2019-1137GHSA-627q-5fv4-r68q

Cross-site scripting in Microsoft Exchange Server 2016

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'.

Why it matters now

EPSS 0.01581 75th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Exchange Server 2016Cumulative Update 12; Cumulative Update 13—No fix listedCNA
MicrosoftMicrosoft Exchange Server 2019Cumulative Update 1; Cumulative Update 2—No fix listedCNA
MicrosoftMicrosoft Exchange Server 2013Cumulative Update 23—No fix listedCNA
  • Microsoft Exchange Server 2016 VendorMicrosoft Affected Cumulative Update 12; Cumulative Update 13 Fixed in — No fix listed CNA
  • Microsoft Exchange Server 2019 VendorMicrosoft Affected Cumulative Update 1; Cumulative Update 2 Fixed in — No fix listed CNA
  • Microsoft Exchange Server 2013 VendorMicrosoft Affected Cumulative Update 23 Fixed in — No fix listed CNA

CPE configurations NVD · 41

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:exchange_server:2013:-:*:*:*:*:*:*2013VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_1:*:*:*:*:*:*2013 cumulative_update_1VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_10:*:*:*:*:*:*2013 cumulative_update_10VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_11:*:*:*:*:*:*2013 cumulative_update_11VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_12:*:*:*:*:*:*2013 cumulative_update_12VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_13:*:*:*:*:*:*2013 cumulative_update_13VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_14:*:*:*:*:*:*2013 cumulative_update_14VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_15:*:*:*:*:*:*2013 cumulative_update_15VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_16:*:*:*:*:*:*2013 cumulative_update_16VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_17:*:*:*:*:*:*2013 cumulative_update_17VulnerableMicrosoft
  • cpe:2.3:a:microsoft:exchange_server:2013:-:*:*:*:*:*:* Versions 2013 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_1:*:*:*:*:*:* Versions 2013 cumulative_update_1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_10:*:*:*:*:*:* Versions 2013 cumulative_update_10 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_11:*:*:*:*:*:* Versions 2013 cumulative_update_11 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_12:*:*:*:*:*:* Versions 2013 cumulative_update_12 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_13:*:*:*:*:*:* Versions 2013 cumulative_update_13 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_14:*:*:*:*:*:* Versions 2013 cumulative_update_14 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_15:*:*:*:*:*:* Versions 2013 cumulative_update_15 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_16:*:*:*:*:*:* Versions 2013 cumulative_update_16 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_17:*:*:*:*:*:* Versions 2013 cumulative_update_17 Vulnerable ·Microsoft
Show 31 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_18:*:*:*:*:*:*2013 cumulative_update_18VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_19:*:*:*:*:*:*2013 cumulative_update_19VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_2:*:*:*:*:*:*2013 cumulative_update_2VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_20:*:*:*:*:*:*2013 cumulative_update_20VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_21:*:*:*:*:*:*2013 cumulative_update_21VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*2013 cumulative_update_22VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*2013 cumulative_update_23VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_3:*:*:*:*:*:*2013 cumulative_update_3VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_5:*:*:*:*:*:*2013 cumulative_update_5VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_6:*:*:*:*:*:*2013 cumulative_update_6VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_7:*:*:*:*:*:*2013 cumulative_update_7VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_8:*:*:*:*:*:*2013 cumulative_update_8VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_9:*:*:*:*:*:*2013 cumulative_update_9VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*2013 sp1VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:*2016VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_1:*:*:*:*:*:*2016 cumulative_update_1VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*2016 cumulative_update_10VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*2016 cumulative_update_11VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*2016 cumulative_update_12VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*2016 cumulative_update_13VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_2:*:*:*:*:*:*2016 cumulative_update_2VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_3:*:*:*:*:*:*2016 cumulative_update_3VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_4:*:*:*:*:*:*2016 cumulative_update_4VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_5:*:*:*:*:*:*2016 cumulative_update_5VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_6:*:*:*:*:*:*2016 cumulative_update_6VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_7:*:*:*:*:*:*2016 cumulative_update_7VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*2016 cumulative_update_8VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*2016 cumulative_update_9VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*2019VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*2019 cumulative_update_1VulnerableMicrosoft
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*2019 cumulative_update_2VulnerableMicrosoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_18:*:*:*:*:*:* Versions 2013 cumulative_update_18 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_19:*:*:*:*:*:* Versions 2013 cumulative_update_19 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_2:*:*:*:*:*:* Versions 2013 cumulative_update_2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_20:*:*:*:*:*:* Versions 2013 cumulative_update_20 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_21:*:*:*:*:*:* Versions 2013 cumulative_update_21 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:* Versions 2013 cumulative_update_22 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:* Versions 2013 cumulative_update_23 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_3:*:*:*:*:*:* Versions 2013 cumulative_update_3 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_5:*:*:*:*:*:* Versions 2013 cumulative_update_5 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_6:*:*:*:*:*:* Versions 2013 cumulative_update_6 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_7:*:*:*:*:*:* Versions 2013 cumulative_update_7 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_8:*:*:*:*:*:* Versions 2013 cumulative_update_8 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_9:*:*:*:*:*:* Versions 2013 cumulative_update_9 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_1:*:*:*:*:*:* Versions 2016 cumulative_update_1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:* Versions 2016 cumulative_update_10 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:* Versions 2016 cumulative_update_11 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:* Versions 2016 cumulative_update_12 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:* Versions 2016 cumulative_update_13 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_2:*:*:*:*:*:* Versions 2016 cumulative_update_2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_3:*:*:*:*:*:* Versions 2016 cumulative_update_3 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_4:*:*:*:*:*:* Versions 2016 cumulative_update_4 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_5:*:*:*:*:*:* Versions 2016 cumulative_update_5 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_6:*:*:*:*:*:* Versions 2016 cumulative_update_6 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_7:*:*:*:*:*:* Versions 2016 cumulative_update_7 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:* Versions 2016 cumulative_update_8 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:* Versions 2016 cumulative_update_9 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:* Versions 2019 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:* Versions 2019 cumulative_update_1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:* Versions 2019 cumulative_update_2 Vulnerable ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1137
  2. 2026-10-03 Alias added: GHSA-627q-5fv4-r68q

References

Patch 1

  • TI-2024-14170 Microsoft Exchange Server Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-19610 Microsoft Exchange Server Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-13547 Microsoft Exchange Server Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-13502 Microsoft Exchange Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-08465 Microsoft Exchange Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-07929 Microsoft Exchange Server Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8
See all 258 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences