Summary
Impact: Spoofing. Microsoft rating: Important. Not known to be exploited, publicly disclosed before the fix — Exploitation More Likely. Customer action: Required.
Details
Is there additional information I need to know about or actions to perform after installing the update?
Yes. Please see the information available in Exchange Server non-RFC compliant P2 FROM header detection.
Why are the Exchange Server updates no longer available on the download center?
Microsoft has temporarily paused the rollout of this update. Please see the known issues section of the Exchange Server blog post.
We are working on addressing this issue and we'll update this CVE when it is resolved.
Security updates
15.02.1258.039 — https://support.microsoft.com/help/5049233
Vulnerabilities 1
-
High 7.5
Microsoft Exchange Server Spoofing Vulnerability
Microsoft Exchange Server Spoofing Vulnerability
Revision history
-
#3
Microsoft has addressed the known issue in the November 12, 2024 security update. We strongly recommend installing the new security update identified by KB5049233. Please see the [Exchange Server blog post](https://techcommunity.microsoft.com/blog/exchange/released-november-2024-exchange-server-security-updates/4293125) for more information.
-
#2
Added an FAQ to indicated that we have temporarily paused the rollout of this update. Please see the Exchange Server [Blog entry](https://techcommunity.microsoft.com/blog/exchange/released-november-2024-exchange-server-security-updates/4293125) for more information.
-
#1
Information published.
References
-
CVE-2024-49040 Microsoft Exchange Server Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49040
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss