Description

Due to a flaw in the Autodiscover service of Exchange Server, an unauthenticated attacker can access its restricted resources and leverage this in conjunction with other vulnerabilities to execute arbitrary code.

Remediation

Upgrade to the latest version of Microsoft Exchange Server.

References

Microsoft Exchange Server Remote Code Execution Vulnerability

Related Vulnerabilities

WordPress Plugin Lightbox Jquery Possible Remote Code Execution (0.24)

node-serialize Insecure Deserialization

WordPress Plugin Groundhogg-Marketing Automation & CRM for WordPress Remote Code Execution (1.3.4)

WordPress Plugin Formidable Forms-Contact Form, Survey, Quiz, Calculator & Custom Form Builder Remote Code Execution (2.05.01)

WordPress Plugin CiviCRM Remote Code Execution (5.24.2)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A

Tags

Code Execution CWE-918 CVE-2021-34473