High 1 exploited CVE WID-SEC-2022-1980 4 CVEs

Microsoft Exchange Server: Mehrere Schwachstellen

Published Nov 8, 2022 · Updated Dec 20, 2022 · Revision 2 · de-DE

Vendor: Microsoft Product: Exchange Server 2013 Cumulative Update 23 Product: Exchange Server 2016 Product: Exchange Server 2016 Cumulative Update 22 Product: Exchange Server 2016 Cumulative Update 23 Product: Exchange Server 2019 Product: Exchange Server 2019 Cumulative Update 11 Product: Exchange Server 2019 Cumulative Update 12 Platform: Windows

Summary

Ein entfernter, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen im Microsoft Exchange Server ausnutzen, um seine Privilegien zu erhöhen und Informationen falsch darzustellen.

Product

Microsoft Exchange Server ist das Serverprodukt für das Client-Server Groupware- und Nachrichtensystem der Firma Microsoft.

Vulnerabilities 4

High 8.8

CVE-2022-41080 Exploited · Ransomware Public exploit EPSS 77%

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12

Nov 9, 2022
KEV Jan 10, 2023
High 8.0

CVE-2022-41078

Microsoft Exchange Server Spoofing Vulnerability

Microsoft Exchange Server Spoofing Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12

Nov 9, 2022
High 8.0

CVE-2022-41079

Microsoft Exchange Server Spoofing Vulnerability

Microsoft Exchange Server Spoofing Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12

Nov 9, 2022
High 7.8

CVE-2022-41123

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12 Microsoft Exchange Server 2019 Cumulative Update 11

Nov 9, 2022

Revision history

2022-12-20 #2
Exploit aufgenommen
2022-11-08 #1
Initiale Fassung

References

CrowdStrike Identifies New Exploit Method for Exchange Bypassing ProxyNotShell Mitigations vom 2022-12-20
https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/
Microsoft Leitfaden für Sicherheitsupdates vom 2022-11-08
https://msrc.microsoft.com/update-guide