Skip to content
OpenAdvisories
Critical 1 exploited CVE MSRC-CVE-2022-41040 1 CVE

Microsoft Exchange Server Elevation of Privilege Vulnerability

Published Sep 13, 2022 · Updated Nov 8, 2022 · Revision 5

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Critical. Exploited according to Microsoft — Exploitation Detected. Customer action: Required.

Details

According to the CVSS metric, privileges required is low (PR:L). Does the attacker need to be in an authenticated role on the Exchange Server?
Yes, the attacker must be authenticated.

Do I need to take further steps to be protected from this vulnerability?
Exchange Server customers should review and apply the mitigation instructions described in Customer Guidance for Reported Zero-day Vulnerabilities in Microsoft Exchange Server.

What privileges can an attacker gain by exploiting this vulnerability?
The privileges acquired by the attacker would be the ability to run PowerShell in the context of the system.

Where can I find more information about this CVE?
Please see Customer Guidance for Reported Zero-day Vulnerabilities in Microsoft Exchange Server for more information

Security updates
15.00.1497.044 — https://support.microsoft.com/help/5019758

Vulnerabilities 1

Revision history

  1. #5

    On November, 8 2022, Microsoft released updates to address this vulnerability. Customers who are running an affected version of Microsoft Exchange Server should install the updates to be protected.

  2. #4

    In the FAQ, updated the information about steps to take to be protected from the vulnerability to refer to [Customer Guidance for Reported Zero-day Vulnerabilities in Microsoft Exchange Server](https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/) for mitigation instructions. This is an informational change only.

  3. #3

    In the FAQ, updated the Condition Input to {UrlDecode:{REQUEST_URI}}. This is an informational change only.

  4. #2

    Updated FAQ information. This is an informational change only.

  5. #1

    Information published.

References