CVE-2008-2143 Information disclosure in n/a

Low 1.9 Published 12 May 2008 Updated 7 Aug 2024

Attackers can access sensitive cached data in browsers due to incorrect HTTP cache-control headers in Microsoft Outlook Web Access.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2008-2143?

CVE-2008-2143 is a low-severity vulnerability in n/a, published on 12 May 2008. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Unspecified versions of Microsoft Outlook Web Access (OWA) use the Cache-Control: no-cache HTTP directive instead of no-store, which might cause web browsers that follow RFC-2616 to cache sensitive information.

Which versions are affected by CVE-2008-2143?

It affects 1 product.

Products include Microsoft Outlook Web Access.

How do I fix CVE-2008-2143?

No fix has been published for CVE-2008-2143 yet. Limit exposure of the affected software until one is available.

Is CVE-2008-2143 being exploited?

There is no known exploitation of CVE-2008-2143 in the wild and no public exploit code.

Sources

Also known as GHSA-48vx-4w7w-9xwc.