MSRC-CVE-2023-21745 — Microsoft Exchange Server Spoofing Vulnerability

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation More Likely. Customer action: Required.

Details

According to the CVSS metric, the attack vector is adjacent (AV:A). What does that mean for this vulnerability?
An authenticated attacker could exploit this vulnerability LAN-side or potentially from the internet.

How could an attacker exploit this vulnerability?
An authenticated attacker could achieve exploitation by using a PowerShell remoting session to the server.

Security updates
15.01.2507.017 — https://support.microsoft.com/help/5022143
15.02.1118.021 — https://support.microsoft.com/help/5022193

Vulnerabilities 1

High 8.0

CVE-2023-21745

Microsoft Exchange Server Spoofing Vulnerability

Microsoft Exchange Server Spoofing Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12 Microsoft Exchange Server 2019 Cumulative Update 11

Jan 10, 2023

Revision history

2023-01-10 #1
Information published.

References

CVE-2023-21745 Microsoft Exchange Server Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21745
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss