CVE-2021-41349
published 2021-11-10CVE-2021-41349: Microsoft Exchange Server Spoofing Vulnerability Microsoft Exchange Server Spoofing Vulnerability
medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
93.88%
99.8th percentile
Microsoft Exchange Server Spoofing Vulnerability
Microsoft Exchange Server Spoofing Vulnerability
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_exchange_server_2013_cumulative_update_23 | >= 15.00.0 < 15.00.1497.026 | 15.00.1497.026 |
| microsoft | microsoft_exchange_server_2016_cumulative_update_21 | >= 15.01.0 < 15.01.2308.020 | 15.01.2308.020 |
| microsoft | microsoft_exchange_server_2016_cumulative_update_22 | >= 15.0.0 < 15.01.2375.017 | 15.01.2375.017 |
| microsoft | microsoft_exchange_server_2019_cumulative_update_10 | >= 15.02.0 < 15.02.0792.019 | 15.02.0792.019 |
| microsoft | microsoft_exchange_server_2019_cumulative_update_11 | >= 15.02.0 < 15.02.0986.014 | 15.02.0986.014 |
| msrc | microsoft_exchange_server_2013_cumulative_update_23 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_21 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_22 | — | — |
| msrc | microsoft_exchange_server_2019_cumulative_update_10 | — | — |
| msrc | microsoft_exchange_server_2019_cumulative_update_11 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/autodiscover/autodiscover.json
other%3Cscript%3Ealert%28document.domain%29%3B+a=%22%3C%2Fscript%3E&x=1
- →Exploit uses a POST request to /autodiscover/autodiscover.json with URL-encoded XSS payload in the body; response body should reflect 'alert(document.domain);' and 'a=""' with Content-Type text/html and HTTP 500 status.
- →Confirmed vulnerable response contains reflected strings 'alert(document.domain);' and 'a=""' in the body, Content-Type header includes 'text/html', and HTTP status is 500. A safe/patched server returns 'A potentially dangerous Request.Form value was detected from the client'.
- →Shodan queries to identify potentially exposed Microsoft Exchange servers: search for vuln:cve-2021-26855, favicon hash 1768726119, or title 'outlook'.
- →FOFA queries to identify potentially exposed Microsoft Exchange servers: title="outlook" or icon_hash=1768726119.
- ·This CVE is distinct from CVE-2021-42305, which is a separate Microsoft Exchange Server spoofing vulnerability; ensure detection rules target the correct CVE.
- ·Exploit status is publicly disclosed but not yet observed as exploited in the wild at time of advisory publication; however, EPSS score of 0.91098 (99.6th percentile) indicates high exploitation probability. ↗
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
cvelistv56.5MEDIUM
vulncheck6.5MEDIUM
vendor_msrc6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-ch43-44fr-3cm6: Microsoft Exchange Server Spoofing Vulnerability This CVE ID is unique from CVE-2021-41349
ghsa_unreviewed·2022-05-24·CVSS 6.5
CVE-2021-42305 [MEDIUM] GHSA-ch43-44fr-3cm6: Microsoft Exchange Server Spoofing Vulnerability This CVE ID is unique from CVE-2021-41349
Microsoft Exchange Server Spoofing Vulnerability This CVE ID is unique from CVE-2021-41349.
GHSA
GHSA-xjg9-924r-39mj: Microsoft Exchange Server Spoofing Vulnerability This CVE ID is unique from CVE-2021-42305
ghsa_unreviewed·2022-05-24·CVSS 6.5
CVE-2021-41349 [MEDIUM] GHSA-xjg9-924r-39mj: Microsoft Exchange Server Spoofing Vulnerability This CVE ID is unique from CVE-2021-42305
Microsoft Exchange Server Spoofing Vulnerability This CVE ID is unique from CVE-2021-42305.
CVEList
Microsoft Exchange Server Spoofing Vulnerability
cvelistv5·2021-11-10·CVSS 6.5
CVE-2021-41349 [MEDIUM] Microsoft Exchange Server Spoofing Vulnerability
Microsoft Exchange Server Spoofing Vulnerability
Microsoft Exchange Server Spoofing Vulnerability
VulnCheck
Microsoft Exchange Server Spoofing Vulnerability
vulncheck·2021·CVSS 6.5
CVE-2021-41349 [MEDIUM] Microsoft Exchange Server Spoofing Vulnerability
Microsoft Exchange Server Spoofing Vulnerability
Microsoft Exchange Server Spoofing Vulnerability
Affected: Microsoft Exchange Server
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://unit42.paloaltonetworks.com/network-security-trends-cross-site-scripting/
Exploit PoC: https://vulncheck.com/xdb/10b317290459
Microsoft
Microsoft Exchange Server Spoofing Vulnerability
vendor_msrc·2021-11-09·CVSS 6.5
CVE-2021-41349 [MEDIUM] Microsoft Exchange Server Spoofing Vulnerability
Microsoft Exchange Server Spoofing Vulnerability
Microsoft Exchange Server: Microsoft Exchange Server
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Spoofing
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
Reference: http://www.microsoft.com/download/details.aspx?familyid=8ef4e237-7007-4e30-9525-75ae6e66bb41
Reference: https://support.microsoft.com/help/5007409
Reference: http://www.microsoft.com/download/details.aspx?familyid=de4b96e0-8d0e-4830-8354-7ed2128e6f82
Reference: http://www.microsoft.com/download/details.aspx?familyid=1c42658f-9d60-4afb-a6c6-e35594b17d39
Reference: http://www.microsoft.com/download/details.aspx?familyid=688b79c6-7e43-4332-848d-47e88f60818c
R
No detection rules found.
Nuclei
Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting
nuclei·CVSS 6.5
CVE-2021-41349 [MEDIUM] Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting
Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting
Microsoft Exchange Server is vulnerable to a spoofing vulnerability. Be aware this CVE ID is unique from CVE-2021-42305.
Template:
id: CVE-2021-41349
info:
name: Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting
author: rootxharsh,iamnoooob
severity: medium
description: Microsoft Exchange Server is vulnerable to a spoofing vulnerability. Be aware this CVE ID is unique from CVE-2021-42305.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the targeted user's browser, potentially leading to session hijacking, data theft, or other malicious activities.
remediation: |
Apply the latest security updates provided by Microsoft to m
Unit42
Network Security Trends: November 2021 to January 2022
blogs_unit42·2022-05-31
Network Security Trends: November 2021 to January 2022
Threat Research Center
Threat Research
Vulnerabilities
## Network Security Trends: November 2021 to January 2022
Yue Guan
Published: May 31, 2022
Threat Research
Vulnerabilities
Apache Log4j
Attack analysis
Denial of service
Exploit in Wild
Network security trends
## Executive Summary
Unit 42 researchers continually observe network attacks and search for insights that can assist defenders. Here, we summarize key trends from November 2021 to January 2022. In the following sections, we present our analysis of the most recently published vulnerabilities, including the severity distribution. We also classify vulnerabilities to provide a clear view of the prevalence of, for example, cross-site scripting or denial of service.
Cross-site scripting stood out as a commonly used t
Unit42
Network Security Trends: November 2021 to January 2022
blogs_unit42·2022-05-31·CVSS 9.8
[CRITICAL] Network Security Trends: November 2021 to January 2022
## Executive Summary
Unit 42 researchers continually observe network attacks and search for insights that can assist defenders. Here, we summarize key trends from November 2021 to January 2022. In the following sections, we present our analysis of the most recently published vulnerabilities, including the severity distribution. We also classify vulnerabilities to provide a clear view of the prevalence of, for example, cross-site scripting or denial of service.
Cross-site scripting stood out as a commonly used technique. Among around 6,443 newly published vulnerabilities, we found that a large portion (almost 10.6%) still involve this technique. However, by evaluating around 167 million attack sessions and focusing on the latest exploits in the wild, we conclude that remote code execution
Trendmicro
November Continues Streak of Quiet Patch Tuesdays
blogs_trendmicro·2021-11-10·CVSS 9.0
[CRITICAL] November Continues Streak of Quiet Patch Tuesdays
Ausnutzung von Schwachstellen
## November Continues Streak of Quiet Patch Tuesdays
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November.
By: Trend Micro Nov 10, 2021 Read time: ( words)
Save to Folio
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November (less than half of the vulnerabilities in November last year). Of these 55, four were submitted via the Zero Day Initiative (ZDI).
Critical Vulnerabilities: Defender, Remote Desktop
Two Critical vulne
Trendmicro
November Continues Streak of Quiet Patch Tuesdays
blogs_trendmicro·2021-11-10·CVSS 9.0
[CRITICAL] November Continues Streak of Quiet Patch Tuesdays
Exploits y vulnerabilidades
## November Continues Streak of Quiet Patch Tuesdays
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November.
By: Trend Micro Nov 10, 2021 Read time: ( words)
Save to Folio
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November (less than half of the vulnerabilities in November last year). Of these 55, four were submitted via the Zero Day Initiative (ZDI).
Critical Vulnerabilities: Defender, Remote Desktop
Two Critical vulnera
Trendmicro
November Continues Streak of Quiet Patch Tuesdays
blogs_trendmicro·2021-11-10·CVSS 9.0
[CRITICAL] November Continues Streak of Quiet Patch Tuesdays
Exploits & Vulnerabilities
## November Continues Streak of Quiet Patch Tuesdays
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November.
By: Trend Micro Nov 10, 2021 Read time: ( words)
Save to Folio
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November (less than half of the vulnerabilities in November last year). Of these 55, four were submitted via the Zero Day Initiative (ZDI).
Critical Vulnerabilities: Defender, Remote Desktop
Two Critical vulnerab
Trendmicro
November Continues Streak of Quiet Patch Tuesdays
blogs_trendmicro·2021-11-10·CVSS 9.0
[CRITICAL] November Continues Streak of Quiet Patch Tuesdays
Exploits & Vulnerabilities
## November Continues Streak of Quiet Patch Tuesdays
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November.
By: Trend Micro 2021/11/10 Read time: ( words)
Save to Folio
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November (less than half of the vulnerabilities in November last year). Of these 55, four were submitted via the Zero Day Initiative (ZDI).
Critical Vulnerabilities: Defender, Remote Desktop
Two Critical vulnerabil
Trendmicro
November Continues Streak of Quiet Patch Tuesdays
blogs_trendmicro·2021-11-10·CVSS 9.0
[CRITICAL] November Continues Streak of Quiet Patch Tuesdays
Exploits & Vulnerabilities
# November Continues Streak of Quiet Patch Tuesdays
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November.
By: Trend Micro
2021/11/10
Read time: ( words)
Save to Folio
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November (less than half of the vulnerabilities in November last year). Of these 55, four were submitted via the Zero Day Initiative (ZDI).
Critical Vulnerabilities: Defender, Remote Desktop
Two Critical vulnerabil
Trendmicro
November Continues Streak of Quiet Patch Tuesdays
blogs_trendmicro·2021-11-10·CVSS 9.0
[CRITICAL] November Continues Streak of Quiet Patch Tuesdays
Sfruttamento vulnerabilità
## November Continues Streak of Quiet Patch Tuesdays
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November.
By: Trend Micro Nov 10, 2021 Read time: ( words)
Save to Folio
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November (less than half of the vulnerabilities in November last year). Of these 55, four were submitted via the Zero Day Initiative (ZDI).
Critical Vulnerabilities: Defender, Remote Desktop
Two Critical vulnerab
2021-11-10
Published
Exploited in the wild