Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.
How could an attacker exploit this vulnerability? An authenticated Outlook Web App user could exploit this issue by reusing a valid access token issued to their own mailbox to access attachments stored in another user’s mailbox within the same Exchange organization, without authorization. What type of information could be disclosed by this vulnerability? An attacker could gain unauthorized access to email attachments stored in other users’ mailboxes within the same organization, which may include documents, images, or other files attached to emails.
Anonymous, Vaibhavi Kalgutkar with Microsoft