Skip to content
OpenAdvisories
Critical MSRC-CVE-2022-24477 1 CVE

Microsoft Exchange Server Elevation of Privilege Vulnerability

Published Aug 9, 2022 · Updated Dec 4, 2023 · Revision 4

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited — Exploitation More Likely. Customer action: Required.

Details

According to the CVSS metric, privileges required is low (PR:L). Does the attacker need to be in an authenticated role on the Exchange Server?
Yes, the attacker must be authenticated.

What privileges could be gained by an attacker who successfully exploited the vulnerability?
The attacker would be able to take over the mailboxes of all Exchange users, attackers can send emails, read emails, download attachments.

Are there any more actions I need to take to be protected from this vulnerability?
Yes. Customers running an affected version of Microsoft Exchange need to enable Extended Protection to be protected from this vulnerability. For more information, see Exchange Server Support for Windows Extended Protection.
For more information on this issue, please see The Exchange Blog.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
This vulnerability requires that a user with an affected version of Exchange Server access a malicious server. An attacker would have to host a specially crafted server share or website. An attacker would have no way to force users to visit this specially crafted server share or website, but would have to convince them to visit the server share or website, typically by way of an enticement in an email or chat message.

Security updates
15.00.1497.042 — https://support.microsoft.com/help/5019076
15.01.2375.032 — https://support.microsoft.com/help/5019077

Vulnerabilities 1

Revision history

  1. #4

    Added an acknowledgement. This is an informational change only.

  2. #3

    To address known issue of Outlook Probes not functioning properly with extended protection turned on, Microsoft has updated the Microsoft Exchange security updates. Please see the [Exchange Team Blog](https://techcommunity.microsoft.com/t5/exchange-team-blog/released-october-2022-exchange-server-security-updates/ba-p/3646263) for more information.

  3. #2

    Added an FAQ. This is an information change only.

  4. #1

    Information published.

References