CVE-2023-21709 — Improper Restriction of Excessive Authentication Attempts in Microsoft Exchange Server 2016 Cumulative Update 23

CWE-307 — Improper Restriction of Excessive Authentication AttemptsCWE-502 — Deserialization of Untrusted DataCWE-20 — Improper Input Validation8 documents5 sources
Severity
9.8CRITICALNVD
EPSS
3.0%
top 13.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Microsoft Exchange Server 2016 Cumulative Update 23Microsoft Exchange Server 2019 Cumulative Update 12Microsoft Exchange Server 2019 Cumulative Update 13+1 more
Timeline
PublishedAug 8
Latest updateOct 10

Description

Microsoft Exchange Server Elevation of Privilege Vulnerability

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶NVDmicrosoft/exchange_server2016, 2019+1

Patches

Patch: msrc.microsoft.com ↗Patch: msrc.microsoft.com ↗

🔴Vulnerability Details

2
CVEList
Microsoft Exchange Server Elevation of Privilege Vulnerability↗2023-08-08
▶
GHSA
GHSA-jrpp-v555-xqmp: Microsoft Exchange Server Elevation of Privilege Vulnerability↗2023-08-08
▶

📋Vendor Advisories

2
Microsoft
Microsoft Exchange Server Elevation of Privilege Vulnerability↗2023-08-08
▶
Microsoft
Microsoft Exchange Server Remote Code Execution Vulnerability↗2023-08-08
▶

🕵️Threat Intelligence

1
Bleepingcomputer
Microsoft Exchange gets ‘better’ patch to mitigate critical bug↗2023-10-10
▶
CVE-2023-21709 — Microsoft vulnerability | cvebase