Microsoft Outlook Information Disclosure Vulnerability
Released: Nov 13, 2018
- Assigning CNA
- Microsoft
- CVE.org link
- CVE-2018-8558
- Impact
- Information Disclosure
- Max Severity
- Important
Executive Summary
An information disclosure vulnerability exists when Microsoft Outlook fails to respect "Default link type" settings configured via the SharePoint Online Admin Center.
A malicious user could potentially share anonymously-accessible links to other users via email where these links are intended to be accessed only by specific users.
The security update addresses the vulnerability by correcting how Microsoft Outlook generates links inserted into emails via the "Attach File" interface.
Exploitability
The following table provides an exploitability assessment for this vulnerability at the time of original publication.
- Publicly disclosed
- No
- Exploited
- No
- Exploitability assessment
- Exploitation Less Likely
FAQ
What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vulnerability is unauthorized file system access - reading from the file system.
Acknowledgements
Security Updates
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle.
- Security Update
- -
- Security Update
- -
- Security Update
- https://aka.ms/OfficeSecurityReleases
- Security Update
- https://aka.ms/OfficeSecurityReleases
Disclaimer
Revisions
Information published.