Microsoft Exchange Server Spoofing Vulnerability
CVE-2023-21762

8HIGH

Key Information:

Vendor
Microsoft
Status
Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft Exchange Server 2019 Cumulative Update 12
Microsoft Exchange Server 2019 Cumulative Update 11
Microsoft Exchange Server 2013 Cumulative Update 23
Vendor
CVE Published:
10 January 2023

Badges

📰 News Worthy

Summary

A spoofing vulnerability exists in Microsoft Exchange Server, potentially allowing an attacker to impersonate another user and send malicious emails without proper authentication. This can facilitate phishing attacks, where the recipient may be misled into believing they are receiving legitimate communication. Organizations using affected versions of Exchange Server should apply security updates promptly to mitigate the risk of exploitation. For further details, refer to Microsoft's advisory.

Affected Version(s)

Microsoft Exchange Server 2013 Cumulative Update 23 x64-based Systems 15.00.0 < 15.00.1497.045

Microsoft Exchange Server 2016 Cumulative Update 23 x64-based Systems 15.01.0 < 15.01.2507.017

Microsoft Exchange Server 2019 Cumulative Update 11 x64-based Systems 15.02.0 < 15.02.0986.037

News Articles

favicon imageBornCity

Exchange Server Security Updates (January 10, 2023)

[German]Microsoft has released security updates for Exchange Server 2013, Exchange Server 2016 and Exchange Server 2019 as of January 10, 2023. These security updates close two vulnerabilities (Elevation of Privilege and Spoofing) in this software. These updates should be installed on systems in a t...

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 📰

    First article discovered by BornCity

  • Vulnerability published

  • Vulnerability Reserved

.