Is this Diffie-Hellman key exchange variant vulnerable to man-in-the-middle attacks?
It is secure against private key exposure but not against replay attacks by Eve. A three-way protocol avoids this, and doesn't need to use timestamps. The description below is from Delfs and Knebl's book Introduction to Cryptography.


  Each user, say Alice, has a key pair
  $(e_A, d_A)$ for encryption and another key pair $(s_A, v_A)$ for digital signatures.
  
  It is assumed that everyone has access to Alice’s authentic public keys, $e_A$
  and $v_A$, for encryption and the verification of signatures. Define the signature algorithm as the pair $Sign(),Verify(),$ the encryption algorithm is DH, using public key $e_A$, e.g.
  
  
  Alice chooses $r_A$ at random, sets $t_1 := (B, r_A)$ (where $B$ represents
  Bob’s identity), $s_1 := Sign_{s_A}(t_1)$
  and sends $(t_1, s_1)$ to Bob.
  Bob verifies Alice’s signature, checks that he is the intended
  recipient, chooses $r_B$ and a session key $k$ at random, encrypts
  the session key with Alice’s public key, $c := E_{e_A}(k)$, sets $t_2 :=
(A, r_A, r_B, c)$, signs $t_2$ to get $s_2 := Sign_{s_B}(t_2)$ and 
  sends $(t_2, s_2)$ to Alice.
  Alice verifies Bobs signature, checks that she is the intended recipient
  and that the $r_A$ she received matches the $r_A$ from step 1
  (this prevents replay attacks). If both verifications pass, she is
  convinced that her communication partner is Bob. Now Alice decrypts
  the session key $k$, sets $t_3 := (B, r_B)$, $s_3 := Sign_{s_A}(t_3)$ and
  sends $(t_3, s_3)$ to Bob.
  Bob verifies Alice’s signature and checks that the $r_B$ he received
  matches the $r_B$ from step 2 (this again prevents replay attacks).
  If both verifications pass, Bob and Alice use $k$ as the session key.