Is this Diffie-Hellman key exchange variant vulnerable to man-in-the-middle attacks? As we all know, the Diffie-Hellman key exchange protocol without authentication is vulnerable to a man-in-the-middle attack. And if we use STS(Station-to-Station protocol) instead, it would be secure.

My question is:
Suppose we use a variant of Diffie-Hellman key exchange protocol with signatures like this:


Alice $\rightarrow$ Bob : $Bx = g^{Ax} ,S_a(Bx)$
Alice $\leftarrow$  Bob : $By = g^{Ay} ,S_b(By)$


Then they have a shared key $g^{(Ax\ \times\ Ay)}$.

It's like STS but not the same.


So is it secure against man-in-the-middle attack? 
Suppose Eve is an active man-in-the-middle, will Eve be able to decrypt Alice's or Bob's message later on? (Suppose Alice and Bob won't send Ax,Ay in this channel)
It is secure against private key exposure but not against replay attacks by Eve. A three-way protocol avoids this, and doesn't need to use timestamps. The description below is from Delfs and Knebl's book Introduction to Cryptography.


  Each user, say Alice, has a key pair
  $(e_A, d_A)$ for encryption and another key pair $(s_A, v_A)$ for digital signatures.
  
  It is assumed that everyone has access to Alice’s authentic public keys, $e_A$
  and $v_A$, for encryption and the verification of signatures. Define the signature algorithm as the pair $Sign(),Verify(),$ the encryption algorithm is DH, using public key $e_A$, e.g.
  
  
  Alice chooses $r_A$ at random, sets $t_1 := (B, r_A)$ (where $B$ represents
  Bob’s identity), $s_1 := Sign_{s_A}(t_1)$
  and sends $(t_1, s_1)$ to Bob.
  Bob verifies Alice’s signature, checks that he is the intended
  recipient, chooses $r_B$ and a session key $k$ at random, encrypts
  the session key with Alice’s public key, $c := E_{e_A}(k)$, sets $t_2 :=
(A, r_A, r_B, c)$, signs $t_2$ to get $s_2 := Sign_{s_B}(t_2)$ and 
  sends $(t_2, s_2)$ to Alice.
  Alice verifies Bobs signature, checks that she is the intended recipient
  and that the $r_A$ she received matches the $r_A$ from step 1
  (this prevents replay attacks). If both verifications pass, she is
  convinced that her communication partner is Bob. Now Alice decrypts
  the session key $k$, sets $t_3 := (B, r_B)$, $s_3 := Sign_{s_A}(t_3)$ and
  sends $(t_3, s_3)$ to Bob.
  Bob verifies Alice’s signature and checks that the $r_B$ he received
  matches the $r_B$ from step 2 (this again prevents replay attacks).
  If both verifications pass, Bob and Alice use $k$ as the session key.