Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

msrc логотип

CVE-2023-21554

Опубликовано: 11 апр. 2023
Источник: msrc
CVSS3: 9.8
EPSS Критический

Описание

Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

Меры по смягчению последствий

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors might be helpful in your situation:

The Windows message queuing service, which is a Windows component, needs to be enabled for a system to be exploitable by this vulnerability. This feature can be added via the Control Panel.

You can check to see if there is a service running named Message Queuing and TCP port 1801 is listening on the machine.

FAQ

How could an attacker exploit the vulnerability?

To exploit this vulnerability, an attacker would need to send a specially crafted malicious MSMQ packet to a MSMQ server. This could result in remote code execution on the server side.

Обновления

ПродуктСтатьяОбновление
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2012
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)

Показывать по

Возможность эксплуатации

Publicly Disclosed

No

Exploited

No

Latest Software Release

Exploitation More Likely

DOS

N/A

EPSS

Процентиль: 100%
0.92162
Критический

9.8 Critical

CVSS3

Связанные уязвимости

CVSS3: 9.8
nvd
около 2 лет назад

Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

CVSS3: 9.8
github
около 2 лет назад

Microsoft Message Queuing Remote Code Execution Vulnerability

CVSS3: 9.8
fstec
около 2 лет назад

Уязвимость службы очереди сообщений Microsoft Message Queuing (MSMQ) операционных систем Microsoft Windows, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 100%
0.92162
Критический

9.8 Critical

CVSS3