Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2023-21764 (GCVE-0-2023-21764)
Vulnerability from cvelistv5 – Published: 2023-01-10 00:00 – Updated: 2025-01-01 00:36
VLAI
EPSS
Title
Microsoft Exchange Server Elevation of Privilege Vulnerability
Summary
Microsoft Exchange Server Elevation of Privilege Vulnerability
Severity
CWE
- CWE-426 - Untrusted Search Path
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 11 |
Affected:
15.02.0 , < 15.02.0986.037
(custom)
|
|
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 12 |
Affected:
15.02.0 , < 15.02.1118.021
(custom)
|
|
| Microsoft | Microsoft Exchange Server 2016 Cumulative Update 23 |
Affected:
15.01.0 , < 15.01.2507.017
(custom)
|
Date Public
2023-01-10 08:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T09:51:50.927Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Microsoft Exchange Server Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21764"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft Exchange Server 2019 Cumulative Update 11",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "15.02.0986.037",
"status": "affected",
"version": "15.02.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft Exchange Server 2019 Cumulative Update 12",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "15.02.1118.021",
"status": "affected",
"version": "15.02.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft Exchange Server 2016 Cumulative Update 23",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "15.01.2507.017",
"status": "affected",
"version": "15.01.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_11:*:*:*:*:*:*",
"versionEndExcluding": "15.02.0986.037",
"versionStartIncluding": "15.02.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_12:*:*:*:*:*:*",
"versionEndExcluding": "15.02.1118.021",
"versionStartIncluding": "15.02.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_23:*:*:*:*:*:*",
"versionEndExcluding": "15.01.2507.017",
"versionStartIncluding": "15.01.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2023-01-10T08:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Exchange Server Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-426",
"description": "CWE-426: Untrusted Search Path",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-01T00:36:07.163Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Exchange Server Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21764"
}
],
"title": "Microsoft Exchange Server Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2023-21764",
"datePublished": "2023-01-10T00:00:00.000Z",
"dateReserved": "2022-12-13T00:00:00.000Z",
"dateUpdated": "2025-01-01T00:36:07.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2023-21764",
"date": "2026-05-27",
"epss": "0.00512",
"percentile": "0.66685"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*\", \"matchCriteriaId\": \"FF76AEDA-E574-40ED-B64F-8FDEF8CAC802\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*\", \"matchCriteriaId\": \"435343A4-BF10-461A-ABF2-D511A5FBDA75\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*\", \"matchCriteriaId\": \"B23C8E3E-5243-4DA6-B9AA-F6053084B55E\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Microsoft Exchange Server Elevation of Privilege Vulnerability\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad de elevaci\\u00f3n de privilegios de Microsoft Exchange Server\"}]",
"id": "CVE-2023-21764",
"lastModified": "2024-11-21T07:43:36.157",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"secure@microsoft.com\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
"published": "2023-01-10T22:15:19.117",
"references": "[{\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21764\", \"source\": \"secure@microsoft.com\"}, {\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21764\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"secure@microsoft.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-426\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2023-21764\",\"sourceIdentifier\":\"secure@microsoft.com\",\"published\":\"2023-01-10T22:15:19.117\",\"lastModified\":\"2024-11-21T07:43:36.157\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Microsoft Exchange Server Elevation of Privilege Vulnerability\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de elevaci\u00f3n de privilegios de Microsoft Exchange Server\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-426\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF76AEDA-E574-40ED-B64F-8FDEF8CAC802\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*\",\"matchCriteriaId\":\"435343A4-BF10-461A-ABF2-D511A5FBDA75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*\",\"matchCriteriaId\":\"B23C8E3E-5243-4DA6-B9AA-F6053084B55E\"}]}]}],\"references\":[{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21764\",\"source\":\"secure@microsoft.com\"},{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21764\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
CERTFR-2023-AVI-0025
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer une usurpation d'identité, une exécution de code à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft Exchange Server 2013 Cumulative Update 23 | ||
| Microsoft | N/A | Microsoft Visio 2013 Service Pack 1 (éditions 32 bits) | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 11 | ||
| Microsoft | N/A | Microsoft Exchange Server 2016 Cumulative Update 23 | ||
| Microsoft | N/A | Microsoft Visio 2016 (édition 64 bits) | ||
| Microsoft | N/A | Visual Studio Code | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour 64 bits Systems | ||
| Microsoft | N/A | Microsoft Visio 2016 (édition 32 bits) | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 12 | ||
| Microsoft | N/A | Microsoft Visio 2013 Service Pack 1 (éditions 64 bits) | ||
| Microsoft | N/A | 3D Builder |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Exchange Server 2013 Cumulative Update 23",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visio 2013 Service Pack 1 (\u00e9ditions 32 bits)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 11",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2016 Cumulative Update 23",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visio 2016 (\u00e9dition 64 bits)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio Code",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visio 2016 (\u00e9dition 32 bits)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 12",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visio 2013 Service Pack 1 (\u00e9ditions 64 bits)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "3D Builder",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-21745",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21745"
},
{
"name": "CVE-2023-21788",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21788"
},
{
"name": "CVE-2023-21779",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21779"
},
{
"name": "CVE-2023-21764",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21764"
},
{
"name": "CVE-2023-21735",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21735"
},
{
"name": "CVE-2023-21780",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21780"
},
{
"name": "CVE-2023-21781",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21781"
},
{
"name": "CVE-2023-21786",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21786"
},
{
"name": "CVE-2023-21782",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21782"
},
{
"name": "CVE-2023-21762",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21762"
},
{
"name": "CVE-2023-21784",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21784"
},
{
"name": "CVE-2023-21738",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21738"
},
{
"name": "CVE-2023-21790",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21790"
},
{
"name": "CVE-2023-21789",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21789"
},
{
"name": "CVE-2023-21787",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21787"
},
{
"name": "CVE-2023-21792",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21792"
},
{
"name": "CVE-2023-21791",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21791"
},
{
"name": "CVE-2023-21741",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21741"
},
{
"name": "CVE-2023-21783",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21783"
},
{
"name": "CVE-2023-21736",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21736"
},
{
"name": "CVE-2023-21785",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21785"
},
{
"name": "CVE-2023-21761",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21761"
},
{
"name": "CVE-2023-21737",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21737"
},
{
"name": "CVE-2023-21763",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21763"
},
{
"name": "CVE-2023-21793",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21793"
},
{
"name": "CVE-2023-21734",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21734"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21786 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21786"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21780 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21780"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21779 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21779"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21788 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21788"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21745 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21745"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21781 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21781"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21789 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21789"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21736 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21736"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21785 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21785"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21735 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21735"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21790 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21790"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21762 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21762"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21741 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21741"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21787 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21787"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21761 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21761"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21764 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21764"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21792 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21792"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21738 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21738"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21793 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21793"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21791 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21791"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21782 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21782"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21734 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21734"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21737 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21737"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21763 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21763"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21783 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21783"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21784 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21784"
}
],
"reference": "CERTFR-2023-AVI-0025",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-01-11T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une usurpation d\u0027identit\u00e9, une ex\u00e9cution de code\n\u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2023-AVI-0025
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer une usurpation d'identité, une exécution de code à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft Exchange Server 2013 Cumulative Update 23 | ||
| Microsoft | N/A | Microsoft Visio 2013 Service Pack 1 (éditions 32 bits) | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 11 | ||
| Microsoft | N/A | Microsoft Exchange Server 2016 Cumulative Update 23 | ||
| Microsoft | N/A | Microsoft Visio 2016 (édition 64 bits) | ||
| Microsoft | N/A | Visual Studio Code | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour 64 bits Systems | ||
| Microsoft | N/A | Microsoft Visio 2016 (édition 32 bits) | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 12 | ||
| Microsoft | N/A | Microsoft Visio 2013 Service Pack 1 (éditions 64 bits) | ||
| Microsoft | N/A | 3D Builder |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Exchange Server 2013 Cumulative Update 23",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visio 2013 Service Pack 1 (\u00e9ditions 32 bits)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 11",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2016 Cumulative Update 23",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visio 2016 (\u00e9dition 64 bits)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio Code",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visio 2016 (\u00e9dition 32 bits)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 12",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visio 2013 Service Pack 1 (\u00e9ditions 64 bits)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "3D Builder",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-21745",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21745"
},
{
"name": "CVE-2023-21788",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21788"
},
{
"name": "CVE-2023-21779",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21779"
},
{
"name": "CVE-2023-21764",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21764"
},
{
"name": "CVE-2023-21735",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21735"
},
{
"name": "CVE-2023-21780",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21780"
},
{
"name": "CVE-2023-21781",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21781"
},
{
"name": "CVE-2023-21786",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21786"
},
{
"name": "CVE-2023-21782",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21782"
},
{
"name": "CVE-2023-21762",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21762"
},
{
"name": "CVE-2023-21784",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21784"
},
{
"name": "CVE-2023-21738",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21738"
},
{
"name": "CVE-2023-21790",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21790"
},
{
"name": "CVE-2023-21789",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21789"
},
{
"name": "CVE-2023-21787",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21787"
},
{
"name": "CVE-2023-21792",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21792"
},
{
"name": "CVE-2023-21791",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21791"
},
{
"name": "CVE-2023-21741",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21741"
},
{
"name": "CVE-2023-21783",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21783"
},
{
"name": "CVE-2023-21736",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21736"
},
{
"name": "CVE-2023-21785",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21785"
},
{
"name": "CVE-2023-21761",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21761"
},
{
"name": "CVE-2023-21737",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21737"
},
{
"name": "CVE-2023-21763",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21763"
},
{
"name": "CVE-2023-21793",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21793"
},
{
"name": "CVE-2023-21734",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21734"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21786 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21786"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21780 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21780"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21779 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21779"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21788 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21788"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21745 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21745"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21781 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21781"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21789 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21789"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21736 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21736"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21785 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21785"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21735 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21735"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21790 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21790"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21762 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21762"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21741 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21741"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21787 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21787"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21761 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21761"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21764 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21764"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21792 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21792"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21738 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21738"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21793 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21793"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21791 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21791"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21782 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21782"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21734 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21734"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21737 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21737"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21763 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21763"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21783 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21783"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21784 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21784"
}
],
"reference": "CERTFR-2023-AVI-0025",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-01-11T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une usurpation d\u0027identit\u00e9, une ex\u00e9cution de code\n\u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
BDU:2023-00246
Vulnerability from fstec - Published: 10.01.2023
VLAI
Title
Уязвимость почтового сервера Microsoft Exchange Server, связанная с недостатками разграничения доступа, позволяющая нарушителю повысить свои привилегии
Description
Уязвимость почтового сервера Microsoft Exchange Server связана с недостатками разграничения доступа. Эксплуатация уязвимости может позволить нарушителю повысить свои привилегии
Severity
Vendor
Microsoft Corp
Software Name
Microsoft Exchange Server
Software Version
2019 Cumulative Update 11 (Microsoft Exchange Server), 2016 Cumulative Update 23 (Microsoft Exchange Server), 2019 Cumulative Update 12 (Microsoft Exchange Server)
Possible Mitigations
Использование рекомендаций производителя:
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-21764
Reference
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-21764
CWE
CWE-264
{
"CVSS 2.0": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
"CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"CVSS 4.0": null,
"remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "TO130",
"remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": "TO130 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f Exchange Server 2019 CU12 (KB5022193)",
"\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Microsoft Corp",
"\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "2019 Cumulative Update 11 (Microsoft Exchange Server), 2016 Cumulative Update 23 (Microsoft Exchange Server), 2019 Cumulative Update 12 (Microsoft Exchange Server)",
"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-21764",
"\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "10.01.2023",
"\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "27.01.2023",
"\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "20.01.2023",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2023-00246",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2023-21764",
"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
"\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
"\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Microsoft Exchange Server",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Microsoft Exchange Server, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u0440\u0430\u0437\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438",
"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0420\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f, \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c (CWE-264)",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Microsoft Exchange Server \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u0440\u0430\u0437\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438",
"\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
"\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430",
"\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438",
"\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-21764",
"\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
"\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
"\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-264",
"\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)"
}
CNVD-2023-51374
Vulnerability from cnvd - Published: 2023-06-26
VLAI
Title
Microsoft Exchange Server权限提升漏洞（CNVD-2023-51374）
Description
Microsoft Exchange Server是美国微软（Microsoft）公司的一套电子邮件服务程序。它提供邮件存取、储存、转发，语音邮件，邮件过滤筛选等功能。
Microsoft Exchange Server存在权限提升漏洞，攻击者可利用该漏洞获取SYSTEM权限。
Severity
高
Patch Name
Microsoft Exchange Server权限提升漏洞（CNVD-2023-51374）的补丁
Patch Description
Microsoft Exchange Server是美国微软（Microsoft）公司的一套电子邮件服务程序。它提供邮件存取、储存、转发，语音邮件，邮件过滤筛选等功能。
Microsoft Exchange Server存在权限提升漏洞，攻击者可利用该漏洞获取SYSTEM权限。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
用户可参考如下供应商提供的安全公告获得补丁信息： https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-21764
Reference
https://nvd.nist.gov/vuln/detail/CVE-2023-21764
Impacted products
| Name | ['Microsoft Exchange Server 2019 Cumulative Update 11', 'Microsoft Exchange Server 2019 Cumulative Update 12', 'Microsoft Exchange Server 2016 Cumulative Update 23'] |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2023-21764",
"cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-21764"
}
},
"description": "Microsoft Exchange Server\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u5957\u7535\u5b50\u90ae\u4ef6\u670d\u52a1\u7a0b\u5e8f\u3002\u5b83\u63d0\u4f9b\u90ae\u4ef6\u5b58\u53d6\u3001\u50a8\u5b58\u3001\u8f6c\u53d1\uff0c\u8bed\u97f3\u90ae\u4ef6\uff0c\u90ae\u4ef6\u8fc7\u6ee4\u7b5b\u9009\u7b49\u529f\u80fd\u3002\n\nMicrosoft Exchange Server\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6SYSTEM\u6743\u9650\u3002",
"formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-21764",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2023-51374",
"openTime": "2023-06-26",
"patchDescription": "Microsoft Exchange Server\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u5957\u7535\u5b50\u90ae\u4ef6\u670d\u52a1\u7a0b\u5e8f\u3002\u5b83\u63d0\u4f9b\u90ae\u4ef6\u5b58\u53d6\u3001\u50a8\u5b58\u3001\u8f6c\u53d1\uff0c\u8bed\u97f3\u90ae\u4ef6\uff0c\u90ae\u4ef6\u8fc7\u6ee4\u7b5b\u9009\u7b49\u529f\u80fd\u3002\r\n\r\nMicrosoft Exchange Server\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6SYSTEM\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Microsoft Exchange Server\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2023-51374\uff09\u7684\u8865\u4e01",
"products": {
"product": [
"Microsoft Exchange Server 2019 Cumulative Update 11",
"Microsoft Exchange Server 2019 Cumulative Update 12",
"Microsoft Exchange Server 2016 Cumulative Update 23"
]
},
"referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2023-21764",
"serverity": "\u9ad8",
"submitTime": "2023-01-13",
"title": "Microsoft Exchange Server\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2023-51374\uff09"
}
FKIE_CVE-2023-21764
Vulnerability from fkie_nvd - Published: 2023-01-10 22:15 - Updated: 2024-11-21 07:43
Severity
Summary
Microsoft Exchange Server Elevation of Privilege Vulnerability
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2019 | |
| microsoft | exchange_server | 2019 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*",
"matchCriteriaId": "FF76AEDA-E574-40ED-B64F-8FDEF8CAC802",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*",
"matchCriteriaId": "435343A4-BF10-461A-ABF2-D511A5FBDA75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*",
"matchCriteriaId": "B23C8E3E-5243-4DA6-B9AA-F6053084B55E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Microsoft Exchange Server Elevation of Privilege Vulnerability"
},
{
"lang": "es",
"value": "Vulnerabilidad de elevaci\u00f3n de privilegios de Microsoft Exchange Server"
}
],
"id": "CVE-2023-21764",
"lastModified": "2024-11-21T07:43:36.157",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "secure@microsoft.com",
"type": "Secondary"
}
]
},
"published": "2023-01-10T22:15:19.117",
"references": [
{
"source": "secure@microsoft.com",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21764"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21764"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-426"
}
],
"source": "secure@microsoft.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GHSA-282J-9H8P-XF7H
Vulnerability from github – Published: 2023-01-11 00:30 – Updated: 2023-01-11 00:30
VLAI
Details
Microsoft Exchange Server Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2023-21763.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2023-21764"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-10T22:15:00Z",
"severity": "HIGH"
},
"details": "Microsoft Exchange Server Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2023-21763.",
"id": "GHSA-282j-9h8p-xf7h",
"modified": "2023-01-11T00:30:45Z",
"published": "2023-01-11T00:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21764"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21764"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-21764"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GSD-2023-21764
Vulnerability from gsd - Updated: 2023-12-13 01:20Details
Microsoft Exchange Server Elevation of Privilege Vulnerability
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2023-21764",
"id": "GSD-2023-21764"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2023-21764"
],
"details": "Microsoft Exchange Server Elevation of Privilege Vulnerability",
"id": "GSD-2023-21764",
"modified": "2023-12-13T01:20:26.459254Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2023-21764",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Microsoft Exchange Server 2019 Cumulative Update 11",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "15.02.0",
"version_value": "15.02.0986.037"
}
]
}
},
{
"product_name": "Microsoft Exchange Server 2019 Cumulative Update 12",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "15.02.0",
"version_value": "15.02.1118.021"
}
]
}
},
{
"product_name": "Microsoft Exchange Server 2016 Cumulative Update 23",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "15.01.0",
"version_value": "15.01.2507.017"
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Microsoft Exchange Server Elevation of Privilege Vulnerability"
}
]
},
"impact": {
"cvss": [
{
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Elevation of Privilege"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21764",
"refsource": "MISC",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21764"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2023-21764"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Microsoft Exchange Server Elevation of Privilege Vulnerability"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21764",
"refsource": "MISC",
"tags": [],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21764"
}
]
}
},
"impact": {
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
},
"lastModifiedDate": "2023-04-27T19:15Z",
"publishedDate": "2023-01-10T22:15Z"
}
}
}
MSRC_CVE-2023-21764
Vulnerability from csaf_microsoft - Published: 2023-01-10 08:00 - Updated: 2023-01-10 08:00Summary
Microsoft Exchange Server Elevation of Privilege Vulnerability
Severity
Important
Notes
Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Customer Action: Required. The vulnerability documented by this CVE requires customer action to resolve.
CWE-426
- Untrusted Search Path
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Microsoft Exchange Server 2019 Cumulative Update 11 15.02.0986.037
Microsoft Exchange Server 2019 Cumulative Update 11
|
15.02.0986.037 | ||
|
Microsoft Exchange Server 2019 Cumulative Update 12 15.02.1118.021
Microsoft Exchange Server 2019 Cumulative Update 12
|
15.02.1118.021 | ||
|
Microsoft Exchange Server 2016 Cumulative Update 23 15.01.2507.017
Microsoft Exchange Server 2016 Cumulative Update 23
|
15.01.2507.017 |
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Microsoft Exchange Server 2016 Cumulative Update 23 <15.01.2507.017
Microsoft Exchange Server 2016 Cumulative Update 23
|
<15.01.2507.017 |
Vendor Fix
fix
|
|
|
Microsoft Exchange Server 2019 Cumulative Update 12 <15.02.1118.021
Microsoft Exchange Server 2019 Cumulative Update 12
|
<15.02.1118.021 |
Vendor Fix
fix
|
|
|
Microsoft Exchange Server 2019 Cumulative Update 11 <15.02.0986.037
Microsoft Exchange Server 2019 Cumulative Update 11
|
<15.02.0986.037 |
Vendor Fix
fix
|
Threats
Impact
Elevation of Privilege
Exploit Status
Exploited:No;Latest Software Release:Exploitation Less Likely
References
7 references
| URL | Category |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | self |
| https://msrc.microsoft.com/csaf/2023/msrc_cve-202… | self |
| https://www.microsoft.com/en-us/msrc/exploitabili… | external |
| https://support.microsoft.com/lifecycle | external |
| https://www.first.org/cvss | external |
| https://msrc.microsoft.com/update-guide/vulnerabi… | self |
| https://msrc.microsoft.com/update-guide/vulnerabi… | self |
Acknowledgments
Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative
{
"document": {
"acknowledgments": [
{
"names": [
"Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative"
]
}
],
"aggregate_severity": {
"namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Public",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
"title": "Disclaimer"
},
{
"category": "general",
"text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
"title": "Customer Action"
}
],
"publisher": {
"category": "vendor",
"contact_details": "secure@microsoft.com",
"name": "Microsoft Security Response Center",
"namespace": "https://msrc.microsoft.com"
},
"references": [
{
"category": "self",
"summary": "CVE-2023-21764 Microsoft Exchange Server Elevation of Privilege Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21764"
},
{
"category": "self",
"summary": "CVE-2023-21764 Microsoft Exchange Server Elevation of Privilege Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/csaf/2023/msrc_cve-2023-21764.json"
},
{
"category": "external",
"summary": "Microsoft Exploitability Index",
"url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
},
{
"category": "external",
"summary": "Microsoft Support Lifecycle",
"url": "https://support.microsoft.com/lifecycle"
},
{
"category": "external",
"summary": "Common Vulnerability Scoring System",
"url": "https://www.first.org/cvss"
}
],
"title": "Microsoft Exchange Server Elevation of Privilege Vulnerability",
"tracking": {
"current_release_date": "2023-01-10T08:00:00.000Z",
"generator": {
"date": "2025-01-01T00:35:27.491Z",
"engine": {
"name": "MSRC Generator",
"version": "1.0"
}
},
"id": "msrc_CVE-2023-21764",
"initial_release_date": "2023-01-10T08:00:00.000Z",
"revision_history": [
{
"date": "2023-01-10T08:00:00.000Z",
"legacy_version": "1",
"number": "1",
"summary": "Information published."
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c15.02.0986.037",
"product": {
"name": "Microsoft Exchange Server 2019 Cumulative Update 11 \u003c15.02.0986.037",
"product_id": "3"
}
},
{
"category": "product_version",
"name": "15.02.0986.037",
"product": {
"name": "Microsoft Exchange Server 2019 Cumulative Update 11 15.02.0986.037",
"product_id": "11957"
}
}
],
"category": "product_name",
"name": "Microsoft Exchange Server 2019 Cumulative Update 11"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c15.02.1118.021",
"product": {
"name": "Microsoft Exchange Server 2019 Cumulative Update 12 \u003c15.02.1118.021",
"product_id": "2"
}
},
{
"category": "product_version",
"name": "15.02.1118.021",
"product": {
"name": "Microsoft Exchange Server 2019 Cumulative Update 12 15.02.1118.021",
"product_id": "12038"
}
}
],
"category": "product_name",
"name": "Microsoft Exchange Server 2019 Cumulative Update 12"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c15.01.2507.017",
"product": {
"name": "Microsoft Exchange Server 2016 Cumulative Update 23 \u003c15.01.2507.017",
"product_id": "1"
}
},
{
"category": "product_version",
"name": "15.01.2507.017",
"product": {
"name": "Microsoft Exchange Server 2016 Cumulative Update 23 15.01.2507.017",
"product_id": "12039"
}
}
],
"category": "product_name",
"name": "Microsoft Exchange Server 2016 Cumulative Update 23"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-21764",
"cwe": {
"id": "CWE-426",
"name": "Untrusted Search Path"
},
"notes": [
{
"category": "general",
"text": "Microsoft",
"title": "Assigning CNA"
},
{
"category": "faq",
"text": "An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.",
"title": "What privileges could be gained by an attacker who successfully exploited this vulnerability?"
}
],
"product_status": {
"fixed": [
"11957",
"12038",
"12039"
],
"known_affected": [
"1",
"2",
"3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-21764 Microsoft Exchange Server Elevation of Privilege Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21764"
},
{
"category": "self",
"summary": "CVE-2023-21764 Microsoft Exchange Server Elevation of Privilege Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21764"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2023-01-10T08:00:00.000Z",
"details": "15.02.0986.037:Security Update:https://support.microsoft.com/help/5022193",
"product_ids": [
"3"
],
"url": "https://support.microsoft.com/help/5022193"
},
{
"category": "vendor_fix",
"date": "2023-01-10T08:00:00.000Z",
"details": "15.02.1118.021:Security Update:https://support.microsoft.com/help/5022193",
"product_ids": [
"2"
],
"url": "https://support.microsoft.com/help/5022193"
},
{
"category": "vendor_fix",
"date": "2023-01-10T08:00:00.000Z",
"details": "15.01.2507.017:Security Update:https://support.microsoft.com/help/5022143",
"product_ids": [
"1"
],
"url": "https://support.microsoft.com/help/5022143"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalsScore": 0.0,
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 6.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Elevation of Privilege"
},
{
"category": "exploit_status",
"details": "Exploited:No;Latest Software Release:Exploitation Less Likely"
}
],
"title": "Microsoft Exchange Server Elevation of Privilege Vulnerability"
}
]
}
WID-SEC-W-2023-0058
Vulnerability from csaf_certbund - Published: 2023-01-10 23:00 - Updated: 2023-02-16 23:00Summary
Microsoft Exchange Server: Mehrere Schwachstellen
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Microsoft Exchange Server ist das Serverprodukt für das Client-Server Groupware- und Nachrichtensystem der Firma Microsoft.
Angriff: Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Microsoft Exchange Server ausnutzen, um seine Privilegien zu erhöhen, Informationen offenzulegen und Daten zu manipulieren.
Betroffene Betriebssysteme: - Windows
In Microsoft Exchange Server existieren mehrere Schwachstellen. Die Fehler sind noch nicht im Detail beschrieben. Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, Informationen offenzulegen und Daten zu manipulieren.
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Microsoft Exchange Server 2019 Cumulative Update 11
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_11
|
— | |
|
Microsoft Exchange Server 2013 Cumulative Update 23
Microsoft
|
cpe:/a:microsoft:exchange_server_2013::cumulative_update_23
|
— | |
|
Microsoft Exchange Server 2019 Cumulative Update 12
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_12
|
— | |
|
Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft
|
cpe:/a:microsoft:exchange_server_2016:cumulative_update_23
|
— |
In Microsoft Exchange Server existieren mehrere Schwachstellen. Die Fehler sind noch nicht im Detail beschrieben. Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, Informationen offenzulegen und Daten zu manipulieren.
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Microsoft Exchange Server 2019 Cumulative Update 11
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_11
|
— | |
|
Microsoft Exchange Server 2013 Cumulative Update 23
Microsoft
|
cpe:/a:microsoft:exchange_server_2013::cumulative_update_23
|
— | |
|
Microsoft Exchange Server 2019 Cumulative Update 12
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_12
|
— | |
|
Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft
|
cpe:/a:microsoft:exchange_server_2016:cumulative_update_23
|
— |
In Microsoft Exchange Server existieren mehrere Schwachstellen. Die Fehler sind noch nicht im Detail beschrieben. Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, Informationen offenzulegen und Daten zu manipulieren.
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Microsoft Exchange Server 2019 Cumulative Update 11
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_11
|
— | |
|
Microsoft Exchange Server 2013 Cumulative Update 23
Microsoft
|
cpe:/a:microsoft:exchange_server_2013::cumulative_update_23
|
— | |
|
Microsoft Exchange Server 2019 Cumulative Update 12
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_12
|
— | |
|
Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft
|
cpe:/a:microsoft:exchange_server_2016:cumulative_update_23
|
— |
In Microsoft Exchange Server existieren mehrere Schwachstellen. Die Fehler sind noch nicht im Detail beschrieben. Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, Informationen offenzulegen und Daten zu manipulieren.
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Microsoft Exchange Server 2019 Cumulative Update 11
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_11
|
— | |
|
Microsoft Exchange Server 2013 Cumulative Update 23
Microsoft
|
cpe:/a:microsoft:exchange_server_2013::cumulative_update_23
|
— | |
|
Microsoft Exchange Server 2019 Cumulative Update 12
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_12
|
— | |
|
Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft
|
cpe:/a:microsoft:exchange_server_2016:cumulative_update_23
|
— |
In Microsoft Exchange Server existieren mehrere Schwachstellen. Die Fehler sind noch nicht im Detail beschrieben. Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, Informationen offenzulegen und Daten zu manipulieren.
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Microsoft Exchange Server 2019 Cumulative Update 11
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_11
|
— | |
|
Microsoft Exchange Server 2013 Cumulative Update 23
Microsoft
|
cpe:/a:microsoft:exchange_server_2013::cumulative_update_23
|
— | |
|
Microsoft Exchange Server 2019 Cumulative Update 12
Microsoft / Exchange Server 2019
|
cpe:/a:microsoft:exchange_server_2019:cumulative_update_12
|
— | |
|
Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft
|
cpe:/a:microsoft:exchange_server_2016:cumulative_update_23
|
— |
References
3 references
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Microsoft Exchange Server ist das Serverprodukt f\u00fcr das Client-Server Groupware- und Nachrichtensystem der Firma Microsoft.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Microsoft Exchange Server ausnutzen, um seine Privilegien zu erh\u00f6hen, Informationen offenzulegen und Daten zu manipulieren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2023-0058 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0058.json"
},
{
"category": "self",
"summary": "WID-SEC-2023-0058 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0058"
},
{
"category": "external",
"summary": "Microsoft Leitfaden f\u00fcr Sicherheitsupdates vom 2023-01-10",
"url": "https://msrc.microsoft.com/update-guide"
}
],
"source_lang": "en-US",
"title": "Microsoft Exchange Server: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2023-02-16T23:00:00.000+00:00",
"generator": {
"date": "2024-08-15T17:41:04.748+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.5"
}
},
"id": "WID-SEC-W-2023-0058",
"initial_release_date": "2023-01-10T23:00:00.000+00:00",
"revision_history": [
{
"date": "2023-01-10T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2023-02-16T23:00:00.000+00:00",
"number": "2",
"summary": "Korrektur"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Microsoft Exchange Server 2013 Cumulative Update 23",
"product": {
"name": "Microsoft Exchange Server 2013 Cumulative Update 23",
"product_id": "T014545",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:exchange_server_2013::cumulative_update_23"
}
}
},
{
"category": "product_name",
"name": "Microsoft Exchange Server 2016 Cumulative Update 23",
"product": {
"name": "Microsoft Exchange Server 2016 Cumulative Update 23",
"product_id": "T023152",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:exchange_server_2016:cumulative_update_23"
}
}
},
{
"branches": [
{
"category": "product_name",
"name": "Microsoft Exchange Server 2019 Cumulative Update 11",
"product": {
"name": "Microsoft Exchange Server 2019 Cumulative Update 11",
"product_id": "T021027",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:exchange_server_2019:cumulative_update_11"
}
}
},
{
"category": "product_name",
"name": "Microsoft Exchange Server 2019 Cumulative Update 12",
"product": {
"name": "Microsoft Exchange Server 2019 Cumulative Update 12",
"product_id": "T023151",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:exchange_server_2019:cumulative_update_12"
}
}
}
],
"category": "product_name",
"name": "Exchange Server 2019"
}
],
"category": "vendor",
"name": "Microsoft"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-21764",
"notes": [
{
"category": "description",
"text": "In Microsoft Exchange Server existieren mehrere Schwachstellen. Die Fehler sind noch nicht im Detail beschrieben. Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, Informationen offenzulegen und Daten zu manipulieren."
}
],
"product_status": {
"known_affected": [
"T021027",
"T014545",
"T023151",
"T023152"
]
},
"release_date": "2023-01-10T23:00:00.000+00:00",
"title": "CVE-2023-21764"
},
{
"cve": "CVE-2023-21763",
"notes": [
{
"category": "description",
"text": "In Microsoft Exchange Server existieren mehrere Schwachstellen. Die Fehler sind noch nicht im Detail beschrieben. Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, Informationen offenzulegen und Daten zu manipulieren."
}
],
"product_status": {
"known_affected": [
"T021027",
"T014545",
"T023151",
"T023152"
]
},
"release_date": "2023-01-10T23:00:00.000+00:00",
"title": "CVE-2023-21763"
},
{
"cve": "CVE-2023-21762",
"notes": [
{
"category": "description",
"text": "In Microsoft Exchange Server existieren mehrere Schwachstellen. Die Fehler sind noch nicht im Detail beschrieben. Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, Informationen offenzulegen und Daten zu manipulieren."
}
],
"product_status": {
"known_affected": [
"T021027",
"T014545",
"T023151",
"T023152"
]
},
"release_date": "2023-01-10T23:00:00.000+00:00",
"title": "CVE-2023-21762"
},
{
"cve": "CVE-2023-21761",
"notes": [
{
"category": "description",
"text": "In Microsoft Exchange Server existieren mehrere Schwachstellen. Die Fehler sind noch nicht im Detail beschrieben. Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, Informationen offenzulegen und Daten zu manipulieren."
}
],
"product_status": {
"known_affected": [
"T021027",
"T014545",
"T023151",
"T023152"
]
},
"release_date": "2023-01-10T23:00:00.000+00:00",
"title": "CVE-2023-21761"
},
{
"cve": "CVE-2023-21745",
"notes": [
{
"category": "description",
"text": "In Microsoft Exchange Server existieren mehrere Schwachstellen. Die Fehler sind noch nicht im Detail beschrieben. Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, Informationen offenzulegen und Daten zu manipulieren."
}
],
"product_status": {
"known_affected": [
"T021027",
"T014545",
"T023151",
"T023152"
]
},
"release_date": "2023-01-10T23:00:00.000+00:00",
"title": "CVE-2023-21745"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…