CVE-2023-21709
published 2023-08-08CVE-2023-21709: Microsoft Exchange Server Elevation of Privilege Vulnerability
PriorityP355critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.98%
80.4th percentile
Microsoft Exchange Server Elevation of Privilege Vulnerability
Affected
41 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_msrc9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Microsoft Exchange Server Remote Code Execution Vulnerability
vendor_msrc·2023-08-08·CVSS 8.8
CVE-2023-38185 [CRITICAL] CWE-23 Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
FAQ: According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is none (UI:N). What is the target used in the context of the remote code execution?
The attacker for this vulnerability could target the server accounts in an arbitrary or remote code execution. As an authenticated user, the attacker could attempt to trigger malicious code in the context of the server's account through a network call.
FAQ: According to the CVSS metric, privileges required is low (PR:L). Does the attacker need to be in an authenticated role on the Exchange Server?
Yes, the attacker must be authenticated.
FAQ: How could an attacker exploit this vulnerability?
In a network-based attack, an attacker could trigger mali
Microsoft
Microsoft Exchange Server Remote Code Execution Vulnerability
vendor_msrc·2023-08-08·CVSS 8.0
CVE-2023-35388 [CRITICAL] CWE-502 Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
FAQ: Is there anything that I should be aware of if I'm running a non-English operating system and version of Exchange server?
Yes, an issue has been discovered with the non-English August updates of Exchange Server and you should postpone installing these updates. The script protecting customers from the vulnerability documented by CVE-2023-21709 can be run to protect against the vulnerability without installing the August updates. Microsoft recommends running the script.
August 15, 2023 Update: The known issue affecting the non-English August updates of Exchange Server has been resolved. Microsoft recommends installing the updated packages as soon as possible.
Please see the Exchange Blog for more information.
FAQ: How could
Microsoft
Microsoft Exchange Server Remote Code Execution Vulnerability
vendor_msrc·2023-08-08·CVSS 8.0
CVE-2023-38182 [CRITICAL] CWE-502 Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
FAQ: Is there anything that I should be aware of if I'm running a non-English operating system and version of Exchange server?
Yes, an issue has been discovered with the non-English August updates of Exchange Server and you should postpone installing these updates. The script protecting customers from the vulnerability documented by CVE-2023-21709 can be run to protect against the vulnerability without installing the August updates. Microsoft recommends running the script.
August 15, 2023 Update: The known issue affecting the non-English August updates of Exchange Server has been resolved. Microsoft recommends installing the updated packages as soon as possible.
Please see the Exchange Blog for more information.
FAQ: How could
Microsoft
Microsoft Exchange Server Elevation of Privilege Vulnerability
vendor_msrc·2023-08-08·CVSS 9.8
CVE-2023-21709 [CRITICAL] CWE-307 Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability?
The attacker would be able to login as another user successfully.
FAQ: How could an attacker exploit this vulnerability?
In a network-based attack, an attacker could brute force user account passwords to log in as that user. Microsoft encourages the use of strong passwords that are more difficult for an attacker to brute force.
FAQ: Why is the severity for this CVE rated as Important, but the CVSS score is 9.8?
The Microsoft proprietary severity rating does not align with the CVSS scoring system. In this case, the severity rating of Important (rather than Critical) reflects the fact that brute-force attacks are unlikely to succe
Microsoft
Microsoft Exchange Server Spoofing Vulnerability
vendor_msrc·2023-08-08·CVSS 8.8
CVE-2023-38181 [CRITICAL] CWE-502 Microsoft Exchange Server Spoofing Vulnerability
Microsoft Exchange Server Spoofing Vulnerability
FAQ: How could an attacker exploit this vulnerability?
An authenticated attacker could achieve exploitation by using a PowerShell remoting session to the server.
FAQ: According to the CVSS metric, the attack vector is network (AV:N) and the attack complexity is low (AC:L). What does that mean for this vulnerability?
The attack vector is set to Network because this vulnerability is remotely exploitable and can be exploited from the internet.
The attack complexity is set to Low because an attacker does not require significant prior knowledge of the cluster/system and can achieve repeatable success when attempting to exploit this vulnerability.
FAQ: Is there anything that I should be aware of if I'm running a non-English operating system and
Microsoft
Microsoft Exchange Remote Code Execution Vulnerability
vendor_msrc·2023-08-08·CVSS 8.8
CVE-2023-35368 [CRITICAL] CWE-20 Microsoft Exchange Remote Code Execution Vulnerability
Microsoft Exchange Remote Code Execution Vulnerability
FAQ: How could an attacker exploit this vulnerability?
Successful exploitation of this vulnerability could allow an attacker the ability to gain remote code execution via an in-network attacker calling arbitrary endpoints.
FAQ: Is there anything that I should be aware of if I'm running a non-English operating system and version of Exchange server?
Yes, an issue has been discovered with the non-English August updates of Exchange Server and you should postpone installing these updates. The script protecting customers from the vulnerability documented by CVE-2023-21709 can be run to protect against the vulnerability without installing the August updates. Microsoft recommends running the script.
August 15, 2023 Update: The known issue af
GHSA
GHSA-jrpp-v555-xqmp: Microsoft Exchange Server Elevation of Privilege Vulnerability
ghsa_unreviewed·2023-08-08
CVE-2023-21709 [CRITICAL] CWE-307 GHSA-jrpp-v555-xqmp: Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Microsoft Exchange gets ‘better’ patch to mitigate critical bug
blogs_bleepingcomputer·2023-10-10·CVSS 9.8
CVE-2023-21709 [CRITICAL] Microsoft Exchange gets ‘better’ patch to mitigate critical bug
## Microsoft Exchange gets ‘better’ patch to mitigate critical bug
## Sergiu Gatlan
Even though Microsoft released security updates to fix the vulnerability, it also informed Exchange admins that they'd also have to remove the vulnerable Windows IIS Token Cache module manually or use this PowerShell script to ensure their servers are protected against attacks using CVE-2023-21709 exploits.
As part of this month's Patch Tuesday, Microsoft has now released a new security update (CVE-2023-36434) that fully addresses the CVE-2023-21709 flaw and doesn't require any additional steps.
"During the release of August 2023 SUs, we recommended to use a manual or scripted solution and disable the IIS Token Cache module as a way of addressing CVE-2023-21709," the Exchange Team said .
"Today, Window
Krebs
Microsoft Patch Tuesday, August 2023 Edition
blogs_krebs·2023-08-09·CVSS 9.8
[CRITICAL] Microsoft Patch Tuesday, August 2023 Edition
Microsoft Corp. today issued software updates to plug more than 70 security holes in its Windows operating systems and related products, including multiple zero-day vulnerabilities currently being exploited in the wild.
Six of the flaws fixed today earned Microsoft’s “critical” rating, meaning malware or miscreants could use them to install software on a vulnerable Windows system without any help from users.
Last month, Microsoft acknowledged a series of zero-day vulnerabilities in a variety of Microsoft products that were discovered and exploited in-the-wild attacks. They were assigned a single placeholder designation of CVE-2023-36884 .
Satnam Narang , senior staff research engineer at Tenable, said the August patch batch addresses CVE-2023-36884 , which involves bypassing the Windows
Krebs
Microsoft Patch Tuesday, August 2023 Edition
blogs_krebs·2023-08-09·CVSS 9.8
[CRITICAL] Microsoft Patch Tuesday, August 2023 Edition
Microsoft Corp. today issued software updates to plug more than 70 security holes in its Windows operating systems and related products, including multiple zero-day vulnerabilities currently being exploited in the wild.
Six of the flaws fixed today earned Microsoft’s “critical” rating, meaning malware or miscreants could use them to install software on a vulnerable Windows system without any help from users.
Last month, Microsoft acknowledged a series of zero-day vulnerabilities in a variety of Microsoft products that were discovered and exploited in-the-wild attacks. They were assigned a single placeholder designation of CVE-2023-36884.
Satnam Narang, senior staff research engineer at Tenable, said the August patch batch addresses CVE-2023-36884, which involves bypassing the Windows Se
Qualys
Microsoft and Adobe Patch Tuesday, August 2023 Security Update Review
blogs_qualys·2023-08-08
Microsoft and Adobe Patch Tuesday, August 2023 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for August 2023
Adobe Patches for August 2023
Zero-day Vulnerabilities Patched in August Patch Tuesday Edition
Other Critical Severity Vulnerabilities Patched in August Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
Qualys Monthly Webinar Series
Microsoft has released its August edition of Patch Tuesday. This month’s updates have addressed 89 security vulnerabilities in multiple products, features, and roles.
## Microsof
Tenable
Microsoft’s August 2023 Patch Tuesday Addresses 73 CVEs (CVE-2023-38180)
blogs_tenable·2023-08-08·CVSS 7.5
[HIGH] Microsoft’s August 2023 Patch Tuesday Addresses 73 CVEs (CVE-2023-38180)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
Microsoft Patch Tuesday & Adobe August 2023 Security Fixes | Qualys
blogs_qualys·2023-08-08
Microsoft Patch Tuesday & Adobe August 2023 Security Fixes | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for August 2023
- Adobe Patches for August 2023
- Zero-day Vulnerabilities Patched in August Patch Tuesday Edition
- Other Critical Severity Vulnerabilities Patched in August Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
- Qualys Monthly Webinar Series
Microsoft has released its August edition of Patch Tuesday. This month’s updates have addressed 89 security vulnerabilities in multiple products, features, and roles
2023-08-08
Published