Description

Due to a flaw in the Autodiscover service of Exchange Server, an unauthenticated attacker can access its restricted resources and leverage this in conjunction with other vulnerabilities to execute arbitrary code.

Remediation

Upgrade to the latest version of Microsoft Exchange Server.

References

Microsoft Exchange Server Remote Code Execution Vulnerability

Related Vulnerabilities

WordPress Plugin iThemes Exchange:Simple WP Ecommerce Remote Code Execution (1.14.0)

WordPress Plugin WooCommerce Possible Remote Code Execution (3.5.0)

PHP HTTP POST incorrect MIME header parsing vulnerability

Symfony RCE via weak/predictable APP_SECRET

MongoDB injection

Severity

High

Classification

CVE-2021-34473 CWE-918 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A

Tags

Code Execution