Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-36439

8HIGH

Key Information:

Vendor
Microsoft
Status
Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft Exchange Server 2019 Cumulative Update 13
Microsoft Exchange Server 2019 Cumulative Update 12
Vendor
CVE Published:
14 November 2023

Summary

A significant security vulnerability in Microsoft Exchange Server permits an attacker to execute arbitrary commands on the server. This flaw exploits inadequate input validation, allowing unauthorized actions that can compromise the integrity and confidentiality of the system. IT administrators must apply updated security patches to mitigate the associated risks and protect organizational data.

Affected Version(s)

Microsoft Exchange Server 2016 Cumulative Update 23 x64-based Systems 15.01.0 < 15.01.2507.035

Microsoft Exchange Server 2019 Cumulative Update 12 x64-based Systems 15.02.0 < 15.02.1118.040

Microsoft Exchange Server 2019 Cumulative Update 13 x64-based Systems 15.02.0 < 15.02.1258.028

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.