Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2023-21529 (GCVE-0-2023-21529)
Vulnerability from cvelistv5 – Published: 2023-02-14 19:33 – Updated: 2025-01-01 00:40
VLAI?
EPSS
Summary
Microsoft Exchange Server Remote Code Execution Vulnerability
Severity ?
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 12 |
Affected:
15.02.0 , < 15.02.1118.025
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T09:44:01.279Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Microsoft Exchange Server Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft Exchange Server 2019 Cumulative Update 12",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "15.02.1118.025",
"status": "affected",
"version": "15.02.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft Exchange Server 2019 Cumulative Update 11",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "15.02.0986.041",
"status": "affected",
"version": "15.02.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft Exchange Server 2013 Cumulative Update 23",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "15.00.1497.047",
"status": "affected",
"version": "15.00.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft Exchange Server 2016 Cumulative Update 23",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "15.01.2507.021",
"status": "affected",
"version": "15.01.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_12:*:*:*:*:*:*",
"versionEndExcluding": "15.02.1118.025",
"versionStartIncluding": "15.02.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_11:*:*:*:*:*:*",
"versionEndExcluding": "15.02.0986.041",
"versionStartIncluding": "15.02.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_23:*:*:*:*:*:*",
"versionEndExcluding": "15.00.1497.047",
"versionStartIncluding": "15.00.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_23:*:*:*:*:*:*",
"versionEndExcluding": "15.01.2507.021",
"versionStartIncluding": "15.01.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2023-02-14T08:00:00+00:00",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-01T00:40:42.972Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Exchange Server Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529"
}
],
"title": "Microsoft Exchange Server Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2023-21529",
"datePublished": "2023-02-14T19:33:00.590Z",
"dateReserved": "2022-12-01T14:00:11.197Z",
"dateUpdated": "2025-01-01T00:40:42.972Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*\", \"matchCriteriaId\": \"DA166F2A-D83B-4D50-AD0B-668D813E0585\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*\", \"matchCriteriaId\": \"FF76AEDA-E574-40ED-B64F-8FDEF8CAC802\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*\", \"matchCriteriaId\": \"435343A4-BF10-461A-ABF2-D511A5FBDA75\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*\", \"matchCriteriaId\": \"B23C8E3E-5243-4DA6-B9AA-F6053084B55E\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Microsoft Exchange Server Remote Code Execution Vulnerability\"}]",
"id": "CVE-2023-21529",
"lastModified": "2024-11-21T07:43:01.290",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"secure@microsoft.com\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}]}",
"published": "2023-02-14T20:15:11.743",
"references": "[{\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529\", \"source\": \"secure@microsoft.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"secure@microsoft.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-502\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2023-21529\",\"sourceIdentifier\":\"secure@microsoft.com\",\"published\":\"2023-02-14T20:15:11.743\",\"lastModified\":\"2024-11-21T07:43:01.290\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Microsoft Exchange Server Remote Code Execution Vulnerability\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA166F2A-D83B-4D50-AD0B-668D813E0585\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF76AEDA-E574-40ED-B64F-8FDEF8CAC802\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*\",\"matchCriteriaId\":\"435343A4-BF10-461A-ABF2-D511A5FBDA75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*\",\"matchCriteriaId\":\"B23C8E3E-5243-4DA6-B9AA-F6053084B55E\"}]}]}],\"references\":[{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}"
}
}
CERTFR-2023-AVI-0133
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer une usurpation d'identité, une exécution de code à distance, une élévation de privilèges, une atteinte à la confidentialité des données, un contournement de la fonctionnalité de sécurité et un déni de service.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft Exchange Server 2013 Cumulative Update 23 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.0 | ||
| Microsoft | N/A | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | ||
| Microsoft | N/A | HoloLens 1 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.2 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (CU 18) | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (CU 4) | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 11 | ||
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2022 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft Exchange Server 2016 Cumulative Update 23 | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (CU 4) | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft Dynamics 365 Unified Service Desk | ||
| Microsoft | N/A | Power BI Report Server - January 2023 | ||
| Microsoft | Azure | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 Azure Connectivity Pack | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.1 | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour 64 bits Systems | ||
| Microsoft | N/A | Print 3D | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (CU 31) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.4 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft Defender pour IoT | ||
| Microsoft | N/A | Microsoft Defender Security Intelligence Updates | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.0 | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 12 | ||
| Microsoft | N/A | 3D Builder | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (GDR) |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Exchange Server 2013 Cumulative Update 23",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "HoloLens 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (CU 18)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 11",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2022 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2016 Cumulative Update 23",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 Unified Service Desk",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Power BI Report Server - January 2023",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 Azure Connectivity Pack",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Print 3D",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (CU 31)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Defender pour IoT",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Defender Security Intelligence Updates",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 12",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "3D Builder",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-21715",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21715"
},
{
"name": "CVE-2023-21568",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21568"
},
{
"name": "CVE-2023-23379",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23379"
},
{
"name": "CVE-2022-23521",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23521"
},
{
"name": "CVE-2023-21567",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21567"
},
{
"name": "CVE-2023-21718",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21718"
},
{
"name": "CVE-2023-21716",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21716"
},
{
"name": "CVE-2023-21572",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21572"
},
{
"name": "CVE-2019-15126",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-15126"
},
{
"name": "CVE-2023-21705",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21705"
},
{
"name": "CVE-2023-21529",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21529"
},
{
"name": "CVE-2023-21710",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21710"
},
{
"name": "CVE-2023-21571",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21571"
},
{
"name": "CVE-2023-21778",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21778"
},
{
"name": "CVE-2023-21809",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21809"
},
{
"name": "CVE-2023-23390",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23390"
},
{
"name": "CVE-2023-23377",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23377"
},
{
"name": "CVE-2023-23381",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23381"
},
{
"name": "CVE-2023-21566",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21566"
},
{
"name": "CVE-2023-21806",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21806"
},
{
"name": "CVE-2023-21807",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21807"
},
{
"name": "CVE-2023-21714",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21714"
},
{
"name": "CVE-2023-21706",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21706"
},
{
"name": "CVE-2023-21713",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21713"
},
{
"name": "CVE-2023-21808",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21808"
},
{
"name": "CVE-2023-21573",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21573"
},
{
"name": "CVE-2023-21528",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21528"
},
{
"name": "CVE-2023-41953",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41953"
},
{
"name": "CVE-2023-21704",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21704"
},
{
"name": "CVE-2023-21570",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21570"
},
{
"name": "CVE-2023-21707",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21707"
},
{
"name": "CVE-2023-21815",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21815"
},
{
"name": "CVE-2023-23378",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23378"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21716 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21713 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21713"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2019-15126 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-15126"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21566 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21566"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21808 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21808"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21705 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21705"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21707 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21707"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21568 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21568"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21571 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21571"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21806 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21806"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21573 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21573"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21570 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21570"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21572 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21572"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21714 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23379 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23379"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23377 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23377"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21815 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21815"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21710 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21710"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21715 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21715"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21718 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21718"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21706 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21706"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21529 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21528 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21528"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-23521 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23521"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23378 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23378"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21704 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21704"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21567 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21567"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23390 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23390"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21807 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21807"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21809 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21809"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21778 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21778"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-41953 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41953"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23381 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23381"
}
],
"reference": "CERTFR-2023-AVI-0133",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-02-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une usurpation d\u0027identit\u00e9, une ex\u00e9cution de code\n\u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es, un contournement de la fonctionnalit\u00e9 de\ns\u00e9curit\u00e9 et un d\u00e9ni de service.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2023-AVI-0133
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer une usurpation d'identité, une exécution de code à distance, une élévation de privilèges, une atteinte à la confidentialité des données, un contournement de la fonctionnalité de sécurité et un déni de service.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft Exchange Server 2013 Cumulative Update 23 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.0 | ||
| Microsoft | N/A | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | ||
| Microsoft | N/A | HoloLens 1 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.2 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (CU 18) | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (CU 4) | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 11 | ||
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2022 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft Exchange Server 2016 Cumulative Update 23 | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (CU 4) | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft Dynamics 365 Unified Service Desk | ||
| Microsoft | N/A | Power BI Report Server - January 2023 | ||
| Microsoft | Azure | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 Azure Connectivity Pack | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.1 | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour 64 bits Systems | ||
| Microsoft | N/A | Print 3D | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (CU 31) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.4 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft Defender pour IoT | ||
| Microsoft | N/A | Microsoft Defender Security Intelligence Updates | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.0 | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 12 | ||
| Microsoft | N/A | 3D Builder | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (GDR) |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Exchange Server 2013 Cumulative Update 23",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "HoloLens 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (CU 18)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 11",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2022 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2016 Cumulative Update 23",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 Unified Service Desk",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Power BI Report Server - January 2023",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 Azure Connectivity Pack",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Print 3D",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (CU 31)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Defender pour IoT",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Defender Security Intelligence Updates",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 12",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "3D Builder",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-21715",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21715"
},
{
"name": "CVE-2023-21568",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21568"
},
{
"name": "CVE-2023-23379",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23379"
},
{
"name": "CVE-2022-23521",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23521"
},
{
"name": "CVE-2023-21567",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21567"
},
{
"name": "CVE-2023-21718",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21718"
},
{
"name": "CVE-2023-21716",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21716"
},
{
"name": "CVE-2023-21572",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21572"
},
{
"name": "CVE-2019-15126",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-15126"
},
{
"name": "CVE-2023-21705",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21705"
},
{
"name": "CVE-2023-21529",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21529"
},
{
"name": "CVE-2023-21710",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21710"
},
{
"name": "CVE-2023-21571",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21571"
},
{
"name": "CVE-2023-21778",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21778"
},
{
"name": "CVE-2023-21809",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21809"
},
{
"name": "CVE-2023-23390",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23390"
},
{
"name": "CVE-2023-23377",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23377"
},
{
"name": "CVE-2023-23381",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23381"
},
{
"name": "CVE-2023-21566",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21566"
},
{
"name": "CVE-2023-21806",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21806"
},
{
"name": "CVE-2023-21807",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21807"
},
{
"name": "CVE-2023-21714",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21714"
},
{
"name": "CVE-2023-21706",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21706"
},
{
"name": "CVE-2023-21713",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21713"
},
{
"name": "CVE-2023-21808",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21808"
},
{
"name": "CVE-2023-21573",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21573"
},
{
"name": "CVE-2023-21528",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21528"
},
{
"name": "CVE-2023-41953",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41953"
},
{
"name": "CVE-2023-21704",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21704"
},
{
"name": "CVE-2023-21570",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21570"
},
{
"name": "CVE-2023-21707",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21707"
},
{
"name": "CVE-2023-21815",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21815"
},
{
"name": "CVE-2023-23378",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23378"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21716 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21713 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21713"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2019-15126 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-15126"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21566 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21566"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21808 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21808"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21705 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21705"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21707 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21707"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21568 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21568"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21571 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21571"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21806 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21806"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21573 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21573"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21570 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21570"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21572 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21572"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21714 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23379 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23379"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23377 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23377"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21815 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21815"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21710 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21710"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21715 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21715"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21718 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21718"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21706 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21706"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21529 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21528 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21528"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-23521 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23521"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23378 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23378"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21704 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21704"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21567 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21567"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23390 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23390"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21807 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21807"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21809 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21809"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21778 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21778"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-41953 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41953"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23381 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23381"
}
],
"reference": "CERTFR-2023-AVI-0133",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-02-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une usurpation d\u0027identit\u00e9, une ex\u00e9cution de code\n\u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es, un contournement de la fonctionnalit\u00e9 de\ns\u00e9curit\u00e9 et un d\u00e9ni de service.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
FKIE_CVE-2023-21529
Vulnerability from fkie_nvd - Published: 2023-02-14 20:15 - Updated: 2024-11-21 07:43
Severity ?
Summary
Microsoft Exchange Server Remote Code Execution Vulnerability
References
| URL | Tags | ||
|---|---|---|---|
| secure@microsoft.com | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microsoft | exchange_server | 2013 | |
| microsoft | exchange_server | 2016 | |
| microsoft | exchange_server | 2019 | |
| microsoft | exchange_server | 2019 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*",
"matchCriteriaId": "DA166F2A-D83B-4D50-AD0B-668D813E0585",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*",
"matchCriteriaId": "FF76AEDA-E574-40ED-B64F-8FDEF8CAC802",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*",
"matchCriteriaId": "435343A4-BF10-461A-ABF2-D511A5FBDA75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*",
"matchCriteriaId": "B23C8E3E-5243-4DA6-B9AA-F6053084B55E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
}
],
"id": "CVE-2023-21529",
"lastModified": "2024-11-21T07:43:01.290",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "secure@microsoft.com",
"type": "Primary"
}
]
},
"published": "2023-02-14T20:15:11.743",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "secure@microsoft.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GHSA-HJXR-GV9H-RJXC
Vulnerability from github – Published: 2023-02-14 21:30 – Updated: 2023-02-14 21:30
VLAI?
Details
Microsoft Exchange Server Remote Code Execution Vulnerability
Severity ?
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2023-21529"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-14T20:15:00Z",
"severity": "HIGH"
},
"details": "Microsoft Exchange Server Remote Code Execution Vulnerability",
"id": "GHSA-hjxr-gv9h-rjxc",
"modified": "2023-02-14T21:30:30Z",
"published": "2023-02-14T21:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21529"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
CNVD-2023-51372
Vulnerability from cnvd - Published: 2023-06-26
VLAI Severity ?
Title
Microsoft Exchange Server远程代码执行漏洞（CNVD-2023-51372）
Description
Microsoft Exchange Server是美国微软（Microsoft）公司的一套电子邮件服务程序。它提供邮件存取、储存、转发，语音邮件，邮件过滤筛选等功能。
Microsoft Exchange Server存在远程代码执行漏洞，攻击者可利用此漏洞在系统上执行任意代码。
Severity
高
Patch Name
Microsoft Exchange Server远程代码执行漏洞（CNVD-2023-51372）的补丁
Patch Description
Microsoft Exchange Server是美国微软（Microsoft）公司的一套电子邮件服务程序。它提供邮件存取、储存、转发，语音邮件，邮件过滤筛选等功能。
Microsoft Exchange Server存在远程代码执行漏洞，攻击者可利用此漏洞在系统上执行任意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
用户可参考如下供应商提供的安全公告获得补丁信息： https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529
Reference
https://nvd.nist.gov/vuln/detail/CVE-2023-21529
Impacted products
| Name | ['Microsoft Exchange Server 2013 Cumulative Update 23', 'Microsoft Exchange Server 2019 Cumulative Update 11', 'Microsoft Exchange Server 2019 Cumulative Update 12', 'Microsoft Exchange Server 2016 Cumulative Update 23'] |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2023-21529",
"cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-21529"
}
},
"description": "Microsoft Exchange Server\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u5957\u7535\u5b50\u90ae\u4ef6\u670d\u52a1\u7a0b\u5e8f\u3002\u5b83\u63d0\u4f9b\u90ae\u4ef6\u5b58\u53d6\u3001\u50a8\u5b58\u3001\u8f6c\u53d1\uff0c\u8bed\u97f3\u90ae\u4ef6\uff0c\u90ae\u4ef6\u8fc7\u6ee4\u7b5b\u9009\u7b49\u529f\u80fd\u3002\n\nMicrosoft Exchange Server\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
"formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2023-51372",
"openTime": "2023-06-26",
"patchDescription": "Microsoft Exchange Server\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u5957\u7535\u5b50\u90ae\u4ef6\u670d\u52a1\u7a0b\u5e8f\u3002\u5b83\u63d0\u4f9b\u90ae\u4ef6\u5b58\u53d6\u3001\u50a8\u5b58\u3001\u8f6c\u53d1\uff0c\u8bed\u97f3\u90ae\u4ef6\uff0c\u90ae\u4ef6\u8fc7\u6ee4\u7b5b\u9009\u7b49\u529f\u80fd\u3002\r\n\r\nMicrosoft Exchange Server\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Microsoft Exchange Server\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CNVD-2023-51372\uff09\u7684\u8865\u4e01",
"products": {
"product": [
"Microsoft Exchange Server 2013 Cumulative Update 23",
"Microsoft Exchange Server 2019 Cumulative Update 11",
"Microsoft Exchange Server 2019 Cumulative Update 12",
"Microsoft Exchange Server 2016 Cumulative Update 23"
]
},
"referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2023-21529",
"serverity": "\u9ad8",
"submitTime": "2023-02-17",
"title": "Microsoft Exchange Server\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CNVD-2023-51372\uff09"
}
WID-SEC-W-2023-0368
Vulnerability from csaf_certbund - Published: 2023-02-14 23:00 - Updated: 2023-02-16 23:00Summary
Microsoft Exchange: Mehrere Schwachstellen ermöglichen Codeausführung
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Microsoft Exchange Server ist das Serverprodukt für das Client-Server Groupware- und Nachrichtensystem der Firma Microsoft.
Angriff
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Microsoft Exchange Server 2013, Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 ausnutzen, um beliebigen Programmcode auszuführen.
Betroffene Betriebssysteme
- Windows
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Microsoft Exchange Server ist das Serverprodukt f\u00fcr das Client-Server Groupware- und Nachrichtensystem der Firma Microsoft.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Microsoft Exchange Server 2013, Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 ausnutzen, um beliebigen Programmcode auszuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2023-0368 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0368.json"
},
{
"category": "self",
"summary": "WID-SEC-2023-0368 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0368"
},
{
"category": "external",
"summary": "Microsoft Leitfaden f\u00fcr Sicherheitsupdates vom 2023-02-14",
"url": "https://msrc.microsoft.com/update-guide"
}
],
"source_lang": "en-US",
"title": "Microsoft Exchange: Mehrere Schwachstellen erm\u00f6glichen Codeausf\u00fchrung",
"tracking": {
"current_release_date": "2023-02-16T23:00:00.000+00:00",
"generator": {
"date": "2024-08-15T17:43:36.877+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.5"
}
},
"id": "WID-SEC-W-2023-0368",
"initial_release_date": "2023-02-14T23:00:00.000+00:00",
"revision_history": [
{
"date": "2023-02-14T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2023-02-16T23:00:00.000+00:00",
"number": "2",
"summary": "Korrektur"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Microsoft Exchange Server 2013 Cumulative Update 23",
"product": {
"name": "Microsoft Exchange Server 2013 Cumulative Update 23",
"product_id": "T014545",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:exchange_server_2013::cumulative_update_23"
}
}
},
{
"category": "product_name",
"name": "Microsoft Exchange Server 2016 Cumulative Update 23",
"product": {
"name": "Microsoft Exchange Server 2016 Cumulative Update 23",
"product_id": "T023152",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:exchange_server_2016:cumulative_update_23"
}
}
},
{
"branches": [
{
"category": "product_name",
"name": "Microsoft Exchange Server 2019 Cumulative Update 11",
"product": {
"name": "Microsoft Exchange Server 2019 Cumulative Update 11",
"product_id": "T021027",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:exchange_server_2019:cumulative_update_11"
}
}
},
{
"category": "product_name",
"name": "Microsoft Exchange Server 2019 Cumulative Update 12",
"product": {
"name": "Microsoft Exchange Server 2019 Cumulative Update 12",
"product_id": "T023151",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:exchange_server_2019:cumulative_update_12"
}
}
}
],
"category": "product_name",
"name": "Exchange Server 2019"
}
],
"category": "vendor",
"name": "Microsoft"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-21710",
"notes": [
{
"category": "description",
"text": "In Microsoft Exchange Server 2013, Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 existiert eine Schwachstelle. Diese wird von Microsoft nicht im Detail beschrieben. Ein entfernter, authentisierter Angreifer, der \u00fcber erweiterte Rechte verf\u00fcgt, kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T021027",
"T014545",
"T023151",
"T023152"
]
},
"release_date": "2023-02-14T23:00:00.000+00:00",
"title": "CVE-2023-21710"
},
{
"cve": "CVE-2023-21707",
"notes": [
{
"category": "description",
"text": "In Microsoft Exchange Server 2013, Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 existieren mehrere Schwachstellen. Diese werden von Microsoft nicht im Detail beschrieben. Ein entfernter, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T021027",
"T014545",
"T023151",
"T023152"
]
},
"release_date": "2023-02-14T23:00:00.000+00:00",
"title": "CVE-2023-21707"
},
{
"cve": "CVE-2023-21706",
"notes": [
{
"category": "description",
"text": "In Microsoft Exchange Server 2013, Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 existieren mehrere Schwachstellen. Diese werden von Microsoft nicht im Detail beschrieben. Ein entfernter, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T021027",
"T014545",
"T023151",
"T023152"
]
},
"release_date": "2023-02-14T23:00:00.000+00:00",
"title": "CVE-2023-21706"
},
{
"cve": "CVE-2023-21529",
"notes": [
{
"category": "description",
"text": "In Microsoft Exchange Server 2013, Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 existieren mehrere Schwachstellen. Diese werden von Microsoft nicht im Detail beschrieben. Ein entfernter, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T021027",
"T014545",
"T023151",
"T023152"
]
},
"release_date": "2023-02-14T23:00:00.000+00:00",
"title": "CVE-2023-21529"
}
]
}
GSD-2023-21529
Vulnerability from gsd - Updated: 2023-12-13 01:20Details
Microsoft Exchange Server Remote Code Execution Vulnerability
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2023-21529",
"id": "GSD-2023-21529"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2023-21529"
],
"details": "Microsoft Exchange Server Remote Code Execution Vulnerability",
"id": "GSD-2023-21529",
"modified": "2023-12-13T01:20:26.075633Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2023-21529",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Microsoft Exchange Server 2019 Cumulative Update 12",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "15.02.0",
"version_value": "15.02.1118.025"
}
]
}
},
{
"product_name": "Microsoft Exchange Server 2019 Cumulative Update 11",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "15.02.0",
"version_value": "15.02.0986.041"
}
]
}
},
{
"product_name": "Microsoft Exchange Server 2013 Cumulative Update 23",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "15.00.0",
"version_value": "15.00.1497.047"
}
]
}
},
{
"product_name": "Microsoft Exchange Server 2016 Cumulative Update 23",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "15.01.0",
"version_value": "15.01.2507.021"
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
}
]
},
"impact": {
"cvss": [
{
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Remote Code Execution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529",
"refsource": "MISC",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2023-21529"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529",
"refsource": "MISC",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529"
}
]
}
},
"impact": {
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
},
"lastModifiedDate": "2023-02-22T17:26Z",
"publishedDate": "2023-02-14T20:15Z"
}
}
}
MSRC_CVE-2023-21529
Vulnerability from csaf_microsoft - Published: 2023-02-14 08:00 - Updated: 2023-02-14 08:00Summary
Microsoft Exchange Server Remote Code Execution Vulnerability
Notes
Additional Resources
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
Disclaimer
The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Customer Action
Required. The vulnerability documented by this CVE requires customer action to resolve.
{
"document": {
"acknowledgments": [
{
"names": [
"Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative"
]
},
{
"names": [
"Piotr Bazydlo (@chudypb) of \u003ca href=\"https://www.zerodayinitiative.com/\"\u003eTrend Micro Zero Day Initiative\u003c/a\u003e"
]
},
{
"names": [
"\u003ca href=\"https://github.com/zcgonvh\"\u003ezcgonvh\u003c/a\u003e with 360 noah lab"
]
}
],
"aggregate_severity": {
"namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Public",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
"title": "Disclaimer"
},
{
"category": "general",
"text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
"title": "Customer Action"
}
],
"publisher": {
"category": "vendor",
"contact_details": "secure@microsoft.com",
"name": "Microsoft Security Response Center",
"namespace": "https://msrc.microsoft.com"
},
"references": [
{
"category": "self",
"summary": "CVE-2023-21529 Microsoft Exchange Server Remote Code Execution Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529"
},
{
"category": "self",
"summary": "CVE-2023-21529 Microsoft Exchange Server Remote Code Execution Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/csaf/2023/msrc_cve-2023-21529.json"
},
{
"category": "external",
"summary": "Microsoft Exploitability Index",
"url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
},
{
"category": "external",
"summary": "Microsoft Support Lifecycle",
"url": "https://support.microsoft.com/lifecycle"
},
{
"category": "external",
"summary": "Common Vulnerability Scoring System",
"url": "https://www.first.org/cvss"
}
],
"title": "Microsoft Exchange Server Remote Code Execution Vulnerability",
"tracking": {
"current_release_date": "2023-02-14T08:00:00.000Z",
"generator": {
"date": "2025-01-01T00:40:39.911Z",
"engine": {
"name": "MSRC Generator",
"version": "1.0"
}
},
"id": "msrc_CVE-2023-21529",
"initial_release_date": "2023-02-14T08:00:00.000Z",
"revision_history": [
{
"date": "2023-02-14T08:00:00.000Z",
"legacy_version": "1",
"number": "1",
"summary": "Information published."
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c15.02.1118.025",
"product": {
"name": "Microsoft Exchange Server 2019 Cumulative Update 12 \u003c15.02.1118.025",
"product_id": "2"
}
},
{
"category": "product_version",
"name": "15.02.1118.025",
"product": {
"name": "Microsoft Exchange Server 2019 Cumulative Update 12 15.02.1118.025",
"product_id": "12038"
}
}
],
"category": "product_name",
"name": "Microsoft Exchange Server 2019 Cumulative Update 12"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c15.02.0986.041",
"product": {
"name": "Microsoft Exchange Server 2019 Cumulative Update 11 \u003c15.02.0986.041",
"product_id": "3"
}
},
{
"category": "product_version",
"name": "15.02.0986.041",
"product": {
"name": "Microsoft Exchange Server 2019 Cumulative Update 11 15.02.0986.041",
"product_id": "11957"
}
}
],
"category": "product_name",
"name": "Microsoft Exchange Server 2019 Cumulative Update 11"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c15.00.1497.047",
"product": {
"name": "Microsoft Exchange Server 2013 Cumulative Update 23 \u003c15.00.1497.047",
"product_id": "4"
}
},
{
"category": "product_version",
"name": "15.00.1497.047",
"product": {
"name": "Microsoft Exchange Server 2013 Cumulative Update 23 15.00.1497.047",
"product_id": "11682"
}
}
],
"category": "product_name",
"name": "Microsoft Exchange Server 2013 Cumulative Update 23"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c15.01.2507.021",
"product": {
"name": "Microsoft Exchange Server 2016 Cumulative Update 23 \u003c15.01.2507.021",
"product_id": "1"
}
},
{
"category": "product_version",
"name": "15.01.2507.021",
"product": {
"name": "Microsoft Exchange Server 2016 Cumulative Update 23 15.01.2507.021",
"product_id": "12039"
}
}
],
"category": "product_name",
"name": "Microsoft Exchange Server 2016 Cumulative Update 23"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-21529",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "general",
"text": "Microsoft",
"title": "Assigning CNA"
},
{
"category": "faq",
"text": "The attacker for this vulnerability could target the server accounts in an arbitrary or remote code execution. As an authenticated user, the attacker could attempt to trigger malicious code in the context of the server\u0027s account through a network call.",
"title": "According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is none (UI:N). What is the target used in the context of the remote code execution?"
},
{
"category": "faq",
"text": "Yes, the attacker must be authenticated.",
"title": "According to the CVSS metric, privileges required is low (PR:L). Does the attacker need to be in an authenticated role on the Exchange Server?"
}
],
"product_status": {
"fixed": [
"11682",
"11957",
"12038",
"12039"
],
"known_affected": [
"1",
"2",
"3",
"4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-21529 Microsoft Exchange Server Remote Code Execution Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529"
},
{
"category": "self",
"summary": "CVE-2023-21529 Microsoft Exchange Server Remote Code Execution Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2023-02-14T08:00:00.000Z",
"details": "15.02.1118.025:Security Update:https://support.microsoft.com/help/5023038",
"product_ids": [
"2"
],
"url": "https://support.microsoft.com/help/5023038"
},
{
"category": "vendor_fix",
"date": "2023-02-14T08:00:00.000Z",
"details": "15.02.0986.041:Security Update:https://support.microsoft.com/help/5023038",
"product_ids": [
"3"
],
"url": "https://support.microsoft.com/help/5023038"
},
{
"category": "vendor_fix",
"date": "2023-02-14T08:00:00.000Z",
"details": "15.00.1497.047:Security Update:https://support.microsoft.com/help/5023038",
"product_ids": [
"4"
],
"url": "https://support.microsoft.com/help/5023038"
},
{
"category": "vendor_fix",
"date": "2023-02-14T08:00:00.000Z",
"details": "15.01.2507.021:Security Update:https://support.microsoft.com/help/5023038",
"product_ids": [
"1"
],
"url": "https://support.microsoft.com/help/5023038"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalsScore": 0.0,
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 7.7,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4"
]
}
],
"threats": [
{
"category": "impact",
"details": "Remote Code Execution"
},
{
"category": "exploit_status",
"details": "Exploited:No;Latest Software Release:Exploitation More Likely"
}
],
"title": "Microsoft Exchange Server Remote Code Execution Vulnerability"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…