Skip to content
OpenAdvisories
High MSRC-CVE-2022-30134 1 CVE

Microsoft Exchange Server Information Disclosure Vulnerability

Published Aug 9, 2022 · Updated Oct 11, 2022 · Revision 3

Vendor: Microsoft

Summary

Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

Details

What type of information could be disclosed by this vulnerability?
An attacker who successfully exploited the vulnerability could read targeted email messages.

Are there any more actions I need to take to be protected from this vulnerability?
Yes. Customers running an affected version of Microsoft Exchange need to enable Extended Protection to be protected from this vulnerability. For more information, see Exchange Server Support for Windows Extended Protection.
For more information on this issue, please see The Exchange Blog.

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
Any authenticated user could trigger this vulnerability. It does not require admin or other elevated privileges.

Security updates
15.02.1118.015 — https://support.microsoft.com/help/5019077
15.00.1497.042 — https://support.microsoft.com/help/5019076

Vulnerabilities 1

Revision history

  1. #3

    To address known issue of Outlook Probes not functioning properly with extended protection turned on, Microsoft has updated the Microsoft Exchange security updates. Please see the [Exchange Team Blog](https://techcommunity.microsoft.com/t5/exchange-team-blog/released-october-2022-exchange-server-security-updates/ba-p/3646263) for more information.

  2. #2

    Added FAQ information. This is an informational change only.

  3. #1

    Information published.

References