CVE-2018-8265 — Improper Input Validation in Microsoft Exchange Server

CWE-20 — Improper Input Validation4 documents4 sources
Severity
7.8HIGHNVD
EPSS
19.2%
top 4.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Microsoft Exchange ServerMicrosoft Exchange Server
Timeline
PublishedOct 10
Latest updateMay 13

Description

A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially crafted email messages, aka "Microsoft Exchange Remote Code Execution Vulnerability." This affects Microsoft Exchange Server.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶NVDmicrosoft/exchange_server2013, 2016+1
▶CVEListV5microsoft/microsoft_exchange_server2013 Cumulative Update 21, 2016 Cumulative Update 10+1

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-9g95-pgx7-jwh2: A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially crafted email messages, aka "Microsoft Exchange R↗2022-05-13
▶
CVEList
CVE-2018-8265: A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially crafted email messages, aka "Microsoft Exchange R↗2018-10-10
▶

📋Vendor Advisories

1
Microsoft
Microsoft Exchange Remote Code Execution Vulnerability↗2018-10-09
▶
CVE-2018-8265 — Improper Input Validation in Microsoft | cvebase