CVE-2020-16875

Опубликовано: 11 сент. 2020

Источник: nvd

CVSS3: 8.4

CVSS3: 7.2

CVSS2: 9

EPSS Высокий

Описание

A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.

An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. Exploitation of the vulnerability requires an authenticated user in a certain Exchange role to be compromised.

The security update addresses the vulnerability by correcting how Microsoft Exchange handles cmdlet arguments.

Ссылки

http://packetstormsecurity.com/files/159210/Microsoft-Exchange-Server-DlpUtils-AddTenantDlpPolicy-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16875
Patch
Vendor Advisory
http://packetstormsecurity.com/files/159210/Microsoft-Exchange-Server-DlpUtils-AddTenantDlpPolicy-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16875
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*

cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.84693

Высокий

8.4 High

CVSS3

7.2 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-74

Связанные уязвимости

CVE-2020-16875

CVSS3: 8.4

msrc

больше 5 лет назад

Microsoft Exchange Server Remote Code Execution Vulnerability

GHSA-5rg4-jqjp-6664

CVSS3: 7.2

github

больше 3 лет назад

A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user, aka 'Microsoft Exchange Server Remote Code Execution Vulnerability'.

BDU:2020-04417

CVSS3: 7.2

fstec

больше 5 лет назад

Уязвимость почтового сервера Microsoft Exchange Server, связанная с ошибками обработки объектов в памяти, позволяющая нарушителю выполнить произвольный код

CVE-2021-27065

CVSS3: 7.8

msrc

почти 5 лет назад

Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2021-26858

CVSS3: 7.8

msrc

почти 5 лет назад

Microsoft Exchange Server Remote Code Execution Vulnerability

EPSS

Процентиль: 99%

0.84693

Высокий

8.4 High

CVSS3

7.2 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-74