Описание
Microsoft Exchange Server Elevation of Privilege Vulnerability
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
FAQ
Is Exchange Online affected, and do Exchange Online customers need to take action?
Microsoft has already deployed a related service-side fix to Exchange Online. Exchange Online customers do not need to take any action to receive the fix. Customers using affected on-premises Microsoft Exchange Server products should install the applicable security updates listed in the Security Updates table.
Where can I find more information?
Please see the Exchange blog for more information.
What privileges could be gained by an attacker who successfully exploited this vulnerability?
An authenticated attacker who successfully exploited this vulnerability could gain unauthorized access to other users' mailboxes within the same organization and read email messages and attachments. The vulnerability does not allow access across tenant boundaries.
Обновления
| Продукт | Статья | Обновление |
|---|---|---|
| Microsoft Exchange Server 2016 Cumulative Update 23 | - | |
| Microsoft Exchange Server 2019 Cumulative Update 14 | - | |
| Microsoft Exchange Server 2019 Cumulative Update 15 | - | |
| Microsoft Exchange Server Subscription Edition RTM |
Показывать по
Возможность эксплуатации
Publicly Disclosed
Exploited
Latest Software Release
EPSS
8.8 High
CVSS3
Связанные уязвимости
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.
EPSS
8.8 High
CVSS3