Vulnerability-Lookup

CVE-2023-38182 (GCVE-0-2023-38182)

Vulnerability from cvelistv5 – Published: 2023-08-08 17:08 – Updated: 2025-02-27 21:06

Title

Microsoft Exchange Server Remote Code Execution Vulnerability

Summary

Microsoft Exchange Server Remote Code Execution Vulnerability

Severity

8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 13	Affected: 15.02.0 , < 15.02.1258.025 (custom)
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	Affected: 15.01.0 , < 15.01.2507.032 (custom)
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 12	Affected: 15.02.0 , < 15.02.1118.037 (custom)

Date Public

2023-08-08 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:30:14.191Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Microsoft Exchange Server Remote Code Execution Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-38182",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-26T21:53:34.546069Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T21:06:14.694Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2019 Cumulative Update 13",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.02.1258.025",
              "status": "affected",
              "version": "15.02.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2016 Cumulative Update 23",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.01.2507.032",
              "status": "affected",
              "version": "15.01.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2019 Cumulative Update 12",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.02.1118.037",
              "status": "affected",
              "version": "15.02.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_13:*:*:*:*:*:*",
                  "versionEndExcluding": "15.02.1258.025",
                  "versionStartIncluding": "15.02.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_23:*:*:*:*:*:*",
                  "versionEndExcluding": "15.01.2507.032",
                  "versionStartIncluding": "15.01.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_12:*:*:*:*:*:*",
                  "versionEndExcluding": "15.02.1118.037",
                  "versionStartIncluding": "15.02.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-08-08T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-01T01:59:14.318Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft Exchange Server Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182"
        }
      ],
      "title": "Microsoft Exchange Server Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-38182",
    "datePublished": "2023-08-08T17:08:55.358Z",
    "dateReserved": "2023-07-12T23:41:45.867Z",
    "dateUpdated": "2025-02-27T21:06:14.694Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-38182",
      "date": "2026-05-27",
      "epss": "0.00742",
      "percentile": "0.73201"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*\", \"matchCriteriaId\": \"FF76AEDA-E574-40ED-B64F-8FDEF8CAC802\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*\", \"matchCriteriaId\": \"B23C8E3E-5243-4DA6-B9AA-F6053084B55E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_13:*:*:*:*:*:*\", \"matchCriteriaId\": \"583745C7-B802-4CBE-BD88-B5B9AF9B5371\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Microsoft Exchange Server Remote Code Execution Vulnerability\"}]",
      "id": "CVE-2023-38182",
      "lastModified": "2024-11-21T08:13:01.853",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"secure@microsoft.com\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.0, \"baseSeverity\": \"HIGH\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.1, \"impactScore\": 5.9}]}",
      "published": "2023-08-08T18:15:22.873",
      "references": "[{\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182\", \"source\": \"secure@microsoft.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "secure@microsoft.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"secure@microsoft.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-502\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-38182\",\"sourceIdentifier\":\"secure@microsoft.com\",\"published\":\"2023-08-08T18:15:22.873\",\"lastModified\":\"2024-11-21T08:13:01.853\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Microsoft Exchange Server Remote Code Execution Vulnerability\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.1,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF76AEDA-E574-40ED-B64F-8FDEF8CAC802\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*\",\"matchCriteriaId\":\"B23C8E3E-5243-4DA6-B9AA-F6053084B55E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_13:*:*:*:*:*:*\",\"matchCriteriaId\":\"583745C7-B802-4CBE-BD88-B5B9AF9B5371\"}]}]}],\"references\":[{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Microsoft Exchange Server Remote Code Execution Vulnerability\", \"datePublic\": \"2023-08-08T07:00:00.000Z\", \"cpeApplicability\": [{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_13:*:*:*:*:*:*\", \"versionStartIncluding\": \"15.02.0\", \"versionEndExcluding\": \"15.02.1258.025\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_23:*:*:*:*:*:*\", \"versionStartIncluding\": \"15.01.0\", \"versionEndExcluding\": \"15.01.2507.032\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_12:*:*:*:*:*:*\", \"versionStartIncluding\": \"15.02.0\", \"versionEndExcluding\": \"15.02.1118.037\"}]}]}], \"affected\": [{\"vendor\": \"Microsoft\", \"product\": \"Microsoft Exchange Server 2019 Cumulative Update 13\", \"platforms\": [\"x64-based Systems\"], \"versions\": [{\"version\": \"15.02.0\", \"lessThan\": \"15.02.1258.025\", \"versionType\": \"custom\", \"status\": \"affected\"}]}, {\"vendor\": \"Microsoft\", \"product\": \"Microsoft Exchange Server 2016 Cumulative Update 23\", \"platforms\": [\"x64-based Systems\"], \"versions\": [{\"version\": \"15.01.0\", \"lessThan\": \"15.01.2507.032\", \"versionType\": \"custom\", \"status\": \"affected\"}]}, {\"vendor\": \"Microsoft\", \"product\": \"Microsoft Exchange Server 2019 Cumulative Update 12\", \"platforms\": [\"x64-based Systems\"], \"versions\": [{\"version\": \"15.02.0\", \"lessThan\": \"15.02.1118.037\", \"versionType\": \"custom\", \"status\": \"affected\"}]}], \"descriptions\": [{\"value\": \"Microsoft Exchange Server Remote Code Execution Vulnerability\", \"lang\": \"en-US\"}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"CWE-502: Deserialization of Untrusted Data\", \"lang\": \"en-US\", \"type\": \"CWE\", \"cweId\": \"CWE-502\"}]}], \"providerMetadata\": {\"orgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"shortName\": \"microsoft\", \"dateUpdated\": \"2025-01-01T01:59:14.318Z\"}, \"references\": [{\"name\": \"Microsoft Exchange Server Remote Code Execution Vulnerability\", \"tags\": [\"vendor-advisory\"], \"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182\"}], \"metrics\": [{\"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}], \"cvssV3_1\": {\"version\": \"3.1\", \"baseSeverity\": \"HIGH\", \"baseScore\": 8, \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C\"}}]}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T17:30:14.191Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"name\": \"Microsoft Exchange Server Remote Code Execution Vulnerability\", \"tags\": [\"vendor-advisory\", \"x_transferred\"], \"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182\"}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-38182\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-26T21:53:34.546069Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-26T20:39:28.006Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-38182\", \"assignerOrgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"microsoft\", \"dateReserved\": \"2023-07-12T23:41:45.867Z\", \"datePublished\": \"2023-08-08T17:08:55.358Z\", \"dateUpdated\": \"2025-02-27T21:06:14.694Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CERTFR-2023-AVI-0645

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer un déni de service, une élévation de privilèges, une usurpation d'identité, une exécution de code arbitraire à distance et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Microsoft	N/A	Microsoft Exchange Server 2019 Cumulative Update 13
Microsoft	N/A	Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
Microsoft	N/A	Microsoft SharePoint Enterprise Server 2016
Microsoft	N/A	Microsoft ODBC Driver 17 pour SQL Server sur Linux
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.2
Microsoft	N/A	Microsoft Teams pour Android
Microsoft	N/A	Microsoft ODBC Driver 18 pour SQL Server sur Linux
Microsoft	N/A	Microsoft SQL Server 2022 pour systèmes x64 (CU 5)
Microsoft	N/A	Microsoft OLE DB Driver 19 pour SQL Server
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.6
Microsoft	N/A	Microsoft Teams pour iOS
Microsoft	N/A	HEVC Video Extensions
Microsoft	N/A	Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft	N/A	Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
Microsoft	N/A	Microsoft SQL Server 2019 pour systèmes x64 (CU 21)
Microsoft	N/A	Microsoft Dynamics 365 (on-premises) version 9.1
Microsoft	Office	Microsoft Visual Studio 2010 Tools pour Office Runtime
Microsoft	N/A	HEVC Video Extension
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.4
Microsoft	N/A	Microsoft SharePoint Server Subscription Edition
Microsoft	N/A	Microsoft Dynamics 365 Business Central 2023 Release Wave 1
Microsoft	N/A	Microsoft ODBC Driver 17 pour SQL Server sur MacOS
Microsoft	N/A	Microsoft Dynamics 365 (on-premises) version 9.0
Microsoft	N/A	Microsoft Teams pour Desktop
Microsoft	N/A	Microsoft Exchange Server 2019 Cumulative Update 12
Microsoft	N/A	Microsoft OLE DB Driver 18 pour SQL Server
Microsoft	N/A	Microsoft Teams pour Mac
Microsoft	N/A	Microsoft SharePoint Server 2019
Microsoft	N/A	Microsoft ODBC Driver 18 pour SQL Server sur MacOS

References

Title

Publication Time

CERTFR-2023-AVI-0645

Vulnerability from certfr_avis - Published: - Updated:

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Microsoft	N/A	Microsoft Exchange Server 2019 Cumulative Update 13
Microsoft	N/A	Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
Microsoft	N/A	Microsoft SharePoint Enterprise Server 2016
Microsoft	N/A	Microsoft ODBC Driver 17 pour SQL Server sur Linux
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.2
Microsoft	N/A	Microsoft Teams pour Android
Microsoft	N/A	Microsoft ODBC Driver 18 pour SQL Server sur Linux
Microsoft	N/A	Microsoft SQL Server 2022 pour systèmes x64 (CU 5)
Microsoft	N/A	Microsoft OLE DB Driver 19 pour SQL Server
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.6
Microsoft	N/A	Microsoft Teams pour iOS
Microsoft	N/A	HEVC Video Extensions
Microsoft	N/A	Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft	N/A	Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
Microsoft	N/A	Microsoft SQL Server 2019 pour systèmes x64 (CU 21)
Microsoft	N/A	Microsoft Dynamics 365 (on-premises) version 9.1
Microsoft	Office	Microsoft Visual Studio 2010 Tools pour Office Runtime
Microsoft	N/A	HEVC Video Extension
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.4
Microsoft	N/A	Microsoft SharePoint Server Subscription Edition
Microsoft	N/A	Microsoft Dynamics 365 Business Central 2023 Release Wave 1
Microsoft	N/A	Microsoft ODBC Driver 17 pour SQL Server sur MacOS
Microsoft	N/A	Microsoft Dynamics 365 (on-premises) version 9.0
Microsoft	N/A	Microsoft Teams pour Desktop
Microsoft	N/A	Microsoft Exchange Server 2019 Cumulative Update 12
Microsoft	N/A	Microsoft OLE DB Driver 18 pour SQL Server
Microsoft	N/A	Microsoft Teams pour Mac
Microsoft	N/A	Microsoft SharePoint Server 2019
Microsoft	N/A	Microsoft ODBC Driver 18 pour SQL Server sur MacOS

References

Title

Publication Time

BDU:2023-04637

Vulnerability from fstec - Published: 08.08.2023

Title

Уязвимость почтового сервера Microsoft Exchange Server, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код

Description

Уязвимость почтового сервера Microsoft Exchange Server связана с недостаточной проверкой входных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код

Severity


                    
                      AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vendor

Microsoft Corp

Software Name

Microsoft Exchange Server

Software Version

2016 Cumulative Update 23 (Microsoft Exchange Server), 2019 Cumulative Update 12 (Microsoft Exchange Server), 2019 Cumulative Update 13 (Microsoft Exchange Server)

Possible Mitigations

Использование рекомендаций: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182

Reference

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182 https://www.cybersecurity-help.cz/vdb/SB2023080867

CWE

CWE-20

JSON

To clipboard

{
  "CVSS 2.0": "AV:A/AC:L/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "TO722",
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": "TO722 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Exchange Server 2019 (KB5030524)",
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Microsoft Corp",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "2016 Cumulative Update 23 (Microsoft Exchange Server), 2019 Cumulative Update 12 (Microsoft Exchange Server), 2019 Cumulative Update 13 (Microsoft Exchange Server)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439: \nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "08.08.2023",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "11.08.2023",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "11.08.2023",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2023-04637",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2023-38182",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Microsoft Exchange Server",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Microsoft Exchange Server, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-20)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Microsoft Exchange Server \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182\nhttps://www.cybersecurity-help.cz/vdb/SB2023080867",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-20",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,7)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8)"
}

CNVD-2023-72228

Vulnerability from cnvd - Published: 2023-09-28

Title

Microsoft Exchange Server远程代码执行漏洞（CNVD-2023-72228）

Description

Microsoft Exchange Server是美国微软（Microsoft）公司的一套电子邮件服务程序。它提供邮件存取、储存、转发，语音邮件，邮件过滤筛选等功能。 Microsoft Exchange Server存在远程代码执行漏洞。攻击者可利用该漏洞在系统上执行任意代码。

Severity

高

Patch Name

Microsoft Exchange Server远程代码执行漏洞（CNVD-2023-72228）的补丁

Patch Description

Microsoft Exchange Server是美国微软（Microsoft）公司的一套电子邮件服务程序。它提供邮件存取、储存、转发，语音邮件，邮件过滤筛选等功能。 Microsoft Exchange Server存在远程代码执行漏洞。攻击者可利用该漏洞在系统上执行任意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

用户可参考如下供应商提供的安全公告获得补丁信息： https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182

Reference

https://nvd.nist.gov/vuln/detail/CVE-2023-38182

Impacted products

Name
['Microsoft Exchange Server 2016 Cumulative Update 13', 'Microsoft Exchange Server 2019 Cumulative Update 12', 'Microsoft Exchange Server 2016 Cumulative Update 23']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-38182",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-38182"
    }
  },
  "description": "Microsoft Exchange Server\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u5957\u7535\u5b50\u90ae\u4ef6\u670d\u52a1\u7a0b\u5e8f\u3002\u5b83\u63d0\u4f9b\u90ae\u4ef6\u5b58\u53d6\u3001\u50a8\u5b58\u3001\u8f6c\u53d1\uff0c\u8bed\u97f3\u90ae\u4ef6\uff0c\u90ae\u4ef6\u8fc7\u6ee4\u7b5b\u9009\u7b49\u529f\u80fd\u3002\n\nMicrosoft Exchange Server\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2023-72228",
  "openTime": "2023-09-28",
  "patchDescription": "Microsoft Exchange Server\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u5957\u7535\u5b50\u90ae\u4ef6\u670d\u52a1\u7a0b\u5e8f\u3002\u5b83\u63d0\u4f9b\u90ae\u4ef6\u5b58\u53d6\u3001\u50a8\u5b58\u3001\u8f6c\u53d1\uff0c\u8bed\u97f3\u90ae\u4ef6\uff0c\u90ae\u4ef6\u8fc7\u6ee4\u7b5b\u9009\u7b49\u529f\u80fd\u3002\r\n\r\nMicrosoft Exchange Server\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft Exchange Server\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CNVD-2023-72228\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Microsoft Exchange Server 2016 Cumulative Update 13",
      "Microsoft Exchange Server 2019 Cumulative Update 12",
      "Microsoft Exchange Server 2016 Cumulative Update 23"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2023-38182",
  "serverity": "\u9ad8",
  "submitTime": "2023-08-11",
  "title": "Microsoft Exchange Server\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CNVD-2023-72228\uff09"
}

FKIE_CVE-2023-38182

Vulnerability from fkie_nvd - Published: 2023-08-08 18:15 - Updated: 2024-11-21 08:13

Severity

8.0 (High) - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Microsoft Exchange Server Remote Code Execution Vulnerability

References

	URL	Tags
	secure@microsoft.com	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182	Patch, Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
microsoft	exchange_server	2016
microsoft	exchange_server	2019
microsoft	exchange_server	2019

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*",
              "matchCriteriaId": "FF76AEDA-E574-40ED-B64F-8FDEF8CAC802",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*",
              "matchCriteriaId": "B23C8E3E-5243-4DA6-B9AA-F6053084B55E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_13:*:*:*:*:*:*",
              "matchCriteriaId": "583745C7-B802-4CBE-BD88-B5B9AF9B5371",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
    }
  ],
  "id": "CVE-2023-38182",
  "lastModified": "2024-11-21T08:13:01.853",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 5.9,
        "source": "secure@microsoft.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2023-08-08T18:15:22.873",
  "references": [
    {
      "source": "secure@microsoft.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "secure@microsoft.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-4WV3-22H6-H824

Vulnerability from github – Published: 2023-08-08 18:30 – Updated: 2024-04-04 06:42

Details

Microsoft Exchange Server Remote Code Execution Vulnerability

Severity

8.0 (High)


                  
                    CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-38182"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-08T18:15:22Z",
    "severity": "HIGH"
  },
  "details": "Microsoft Exchange Server Remote Code Execution Vulnerability",
  "id": "GHSA-4wv3-22h6-h824",
  "modified": "2024-04-04T06:42:44Z",
  "published": "2023-08-08T18:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38182"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2023-38182

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Microsoft Exchange Server Remote Code Execution Vulnerability

Aliases

CVE-2023-38182

Aliases

CVE-2023-38182

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-38182",
    "id": "GSD-2023-38182"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-38182"
      ],
      "details": "Microsoft Exchange Server Remote Code Execution Vulnerability",
      "id": "GSD-2023-38182",
      "modified": "2023-12-13T01:20:36.195310Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secure@microsoft.com",
        "ID": "CVE-2023-38182",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Microsoft Exchange Server 2019 Cumulative Update 13",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "15.02.0",
                          "version_value": "15.02.1258.025"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft Exchange Server 2016 Cumulative Update 23",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "15.01.0",
                          "version_value": "15.01.2507.032"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft Exchange Server 2019 Cumulative Update 12",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "15.02.0",
                          "version_value": "15.02.1118.037"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Microsoft"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Remote Code Execution"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182",
            "refsource": "MISC",
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_13:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2023-38182"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.1,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-08-11T14:27Z",
      "publishedDate": "2023-08-08T18:15Z"
    }
  }
}

MSRC_CVE-2023-38182

Vulnerability from csaf_microsoft - Published: 2023-08-08 07:00 - Updated: 2023-08-15 07:00

Summary

Microsoft Exchange Server Remote Code Execution Vulnerability

Severity

Important

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Customer Action: Required. The vulnerability documented by this CVE requires customer action to resolve.

CVE-2023-38182

8.0 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CWE-502 - Deserialization of Untrusted Data

Affected products

Fixed 3 products

Product	Identifier	Version	Remediation
Microsoft Exchange Server 2019 Cumulative Update 12 15.02.1118.037 Microsoft Exchange Server 2019 Cumulative Update 12		15.02.1118.037
Microsoft Exchange Server 2016 Cumulative Update 23 15.01.2507.032 Microsoft Exchange Server 2016 Cumulative Update 23		15.01.2507.032
Microsoft Exchange Server 2019 Cumulative Update 13 15.02.1258.025 Microsoft Exchange Server 2019 Cumulative Update 13		15.02.1258.025

Known affected 3 products

Product	Version	Remediation
Microsoft Exchange Server 2019 Cumulative Update 13 <15.02.1258.025 Microsoft Exchange Server 2019 Cumulative Update 13	<15.02.1258.025	Vendor Fix fix
Microsoft Exchange Server 2016 Cumulative Update 23 <15.01.2507.032 Microsoft Exchange Server 2016 Cumulative Update 23	<15.01.2507.032	Vendor Fix fix
Microsoft Exchange Server 2019 Cumulative Update 12 <15.02.1118.037 Microsoft Exchange Server 2019 Cumulative Update 12	<15.02.1118.037	Vendor Fix fix

Threats

Impact Remote Code Execution

Exploit Status Exploited:No;Latest Software Release:Exploitation More Likely

References

7 references

URL	Category
https://msrc.microsoft.com/update-guide/vulnerabi…	self
https://msrc.microsoft.com/csaf/2023/msrc_cve-202…	self
https://www.microsoft.com/en-us/msrc/exploitabili…	external
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/update-guide/vulnerabi…	self
https://msrc.microsoft.com/update-guide/vulnerabi…	self

Acknowledgments

Anonymous

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Anonymous"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2023-38182 Microsoft Exchange Server Remote Code Execution Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182"
      },
      {
        "category": "self",
        "summary": "CVE-2023-38182 Microsoft Exchange Server Remote Code Execution Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/2023/msrc_cve-2023-38182.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Microsoft Exchange Server Remote Code Execution Vulnerability",
    "tracking": {
      "current_release_date": "2023-08-15T07:00:00.000Z",
      "generator": {
        "date": "2025-01-01T01:58:31.455Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2023-38182",
      "initial_release_date": "2023-08-08T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2023-08-08T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2023-08-09T07:00:00.000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added FAQ regarding a new known issue in the August Exchange security updates."
        },
        {
          "date": "2023-08-15T07:00:00.000Z",
          "legacy_version": "2",
          "number": "3",
          "summary": "The known issue affecting the non-English August updates of Exchange Server has been resolved.  Microsoft recommends installing the updated packages as soon as possible."
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c15.02.1258.025",
            "product": {
              "name": "Microsoft Exchange Server 2019 Cumulative Update 13 \u003c15.02.1258.025",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "15.02.1258.025",
            "product": {
              "name": "Microsoft Exchange Server 2019 Cumulative Update 13 15.02.1258.025",
              "product_id": "12191"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Exchange Server 2019 Cumulative Update 13"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c15.01.2507.032",
            "product": {
              "name": "Microsoft Exchange Server 2016 Cumulative Update 23 \u003c15.01.2507.032",
              "product_id": "2"
            }
          },
          {
            "category": "product_version",
            "name": "15.01.2507.032",
            "product": {
              "name": "Microsoft Exchange Server 2016 Cumulative Update 23 15.01.2507.032",
              "product_id": "12039"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Exchange Server 2016 Cumulative Update 23"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c15.02.1118.037",
            "product": {
              "name": "Microsoft Exchange Server 2019 Cumulative Update 12 \u003c15.02.1118.037",
              "product_id": "3"
            }
          },
          {
            "category": "product_version",
            "name": "15.02.1118.037",
            "product": {
              "name": "Microsoft Exchange Server 2019 Cumulative Update 12 15.02.1118.037",
              "product_id": "12038"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Exchange Server 2019 Cumulative Update 12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-38182",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "Yes, an issue has been discovered with the non-English August updates of Exchange Server and you should postpone installing these updates.  The script protecting customers from the vulnerability documented by CVE-2023-21709 can be run to protect against the vulnerability without installing the August updates. Microsoft recommends running the script.\nAugust 15, 2023 Update: The known issue affecting the non-English August updates of Exchange Server has been resolved.  Microsoft recommends installing the updated packages as soon as possible.\nPlease see the Exchange Blog for more information.",
          "title": "Is there anything that I should be aware of if I\u0027m running a non-English operating system and version of Exchange server?"
        },
        {
          "category": "faq",
          "text": "An authenticated attacker who is on the same intranet as the Exchange server can achieve remote code execution via a PowerShell remoting session.",
          "title": "How could an attacker exploit this vulnerability?"
        },
        {
          "category": "faq",
          "text": "An authenticated attacker could exploit this vulnerability with LAN access.",
          "title": "According to the CVSS metric, the attack vector is adjacent (AV:A). What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "Yes, the attacker must be authenticated with LAN-access and have credentials for a valid Exchange user.",
          "title": "According to the CVSS metric, privileges required is low (PR:L). Does the attacker need to be in an authenticated role on the Exchange Server?"
        }
      ],
      "product_status": {
        "fixed": [
          "12038",
          "12039",
          "12191"
        ],
        "known_affected": [
          "1",
          "2",
          "3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-38182 Microsoft Exchange Server Remote Code Execution Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182"
        },
        {
          "category": "self",
          "summary": "CVE-2023-38182 Microsoft Exchange Server Remote Code Execution Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38182"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-08-08T07:00:00.000Z",
          "details": "15.02.1258.025:Security Update:https://support.microsoft.com/help/5030524",
          "product_ids": [
            "1"
          ],
          "url": "https://support.microsoft.com/help/5030524"
        },
        {
          "category": "vendor_fix",
          "date": "2023-08-08T07:00:00.000Z",
          "details": "15.01.2507.032:Security Update:https://support.microsoft.com/help/5030524",
          "product_ids": [
            "2"
          ],
          "url": "https://support.microsoft.com/help/5030524"
        },
        {
          "category": "vendor_fix",
          "date": "2023-08-08T07:00:00.000Z",
          "details": "15.02.1118.037:Security Update:https://support.microsoft.com/help/5030524",
          "product_ids": [
            "3"
          ],
          "url": "https://support.microsoft.com/help/5030524"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 7.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Remote Code Execution"
        },
        {
          "category": "exploit_status",
          "details": "Exploited:No;Latest Software Release:Exploitation More Likely"
        }
      ],
      "title": "Microsoft Exchange Server Remote Code Execution Vulnerability"
    }
  ]
}

WID-SEC-W-2023-1990

Vulnerability from csaf_certbund - Published: 2023-08-08 22:00 - Updated: 2023-08-15 22:00

Summary

Microsoft Exchange Server: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Microsoft Exchange Server ist das Serverprodukt für das Client-Server Groupware- und Nachrichtensystem der Firma Microsoft.

Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 ausnutzen, um seine Privilegien zu erhöhen, beliebigen Programmcode auszuführen oder Dateien zu manipulieren.

Betroffene Betriebssysteme: - Windows

CVE-2023-38185

In Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 existieren mehrere Schwachstellen. Microsoft veröffentlicht keine Details zu den Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen oder Dateien zu manipulieren.

Affected products

Known affected 3 products

Product	Identifier	Version
Microsoft Exchange Server 2019 Cumulative Update 13 Microsoft / Exchange Server 2019	`cpe:/a:microsoft:exchange_server_2019:cumulative_update_13`	—
Microsoft Exchange Server 2019 Cumulative Update 12 Microsoft / Exchange Server 2019	`cpe:/a:microsoft:exchange_server_2019:cumulative_update_12`	—
Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft	`cpe:/a:microsoft:exchange_server_2016:cumulative_update_23`	—

CVE-2023-38182

Affected products

Known affected 3 products

Product	Identifier	Version
Microsoft Exchange Server 2019 Cumulative Update 13 Microsoft / Exchange Server 2019	`cpe:/a:microsoft:exchange_server_2019:cumulative_update_13`	—
Microsoft Exchange Server 2019 Cumulative Update 12 Microsoft / Exchange Server 2019	`cpe:/a:microsoft:exchange_server_2019:cumulative_update_12`	—
Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft	`cpe:/a:microsoft:exchange_server_2016:cumulative_update_23`	—

CVE-2023-38181

Affected products

Known affected 3 products

Product	Identifier	Version
Microsoft Exchange Server 2019 Cumulative Update 13 Microsoft / Exchange Server 2019	`cpe:/a:microsoft:exchange_server_2019:cumulative_update_13`	—
Microsoft Exchange Server 2019 Cumulative Update 12 Microsoft / Exchange Server 2019	`cpe:/a:microsoft:exchange_server_2019:cumulative_update_12`	—
Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft	`cpe:/a:microsoft:exchange_server_2016:cumulative_update_23`	—

CVE-2023-35388

Affected products

Known affected 3 products

Product	Identifier	Version
Microsoft Exchange Server 2019 Cumulative Update 13 Microsoft / Exchange Server 2019	`cpe:/a:microsoft:exchange_server_2019:cumulative_update_13`	—
Microsoft Exchange Server 2019 Cumulative Update 12 Microsoft / Exchange Server 2019	`cpe:/a:microsoft:exchange_server_2019:cumulative_update_12`	—
Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft	`cpe:/a:microsoft:exchange_server_2016:cumulative_update_23`	—

CVE-2023-35368

Affected products

Known affected 3 products

Product	Identifier	Version
Microsoft Exchange Server 2019 Cumulative Update 13 Microsoft / Exchange Server 2019	`cpe:/a:microsoft:exchange_server_2019:cumulative_update_13`	—
Microsoft Exchange Server 2019 Cumulative Update 12 Microsoft / Exchange Server 2019	`cpe:/a:microsoft:exchange_server_2019:cumulative_update_12`	—
Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft	`cpe:/a:microsoft:exchange_server_2016:cumulative_update_23`	—

CVE-2023-21709

Affected products

Known affected 3 products

Product	Identifier	Version
Microsoft Exchange Server 2019 Cumulative Update 13 Microsoft / Exchange Server 2019	`cpe:/a:microsoft:exchange_server_2019:cumulative_update_13`	—
Microsoft Exchange Server 2019 Cumulative Update 12 Microsoft / Exchange Server 2019	`cpe:/a:microsoft:exchange_server_2019:cumulative_update_12`	—
Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft	`cpe:/a:microsoft:exchange_server_2016:cumulative_update_23`	—

References

5 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://techcommunity.microsoft.com/t5/exchange-t…	external
https://support.microsoft.com/en-us/topic/exchang…	external
https://msrc.microsoft.com/update-guide	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Microsoft Exchange Server ist das Serverprodukt f\u00fcr das Client-Server Groupware- und Nachrichtensystem der Firma Microsoft.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Programmcode auszuf\u00fchren oder Dateien zu manipulieren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-1990 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1990.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-1990 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1990"
      },
      {
        "category": "external",
        "summary": "Re-release of August 2023 Exchange Server Security Update packages vom 2023-08-16",
        "url": "https://techcommunity.microsoft.com/t5/exchange-team-blog/re-release-of-august-2023-exchange-server-security-update/ba-p/3900025"
      },
      {
        "category": "external",
        "summary": "Exchange Server 2019 and 2016 August 2023 security update installation fails on non-English operating systems vom 2023-08-10",
        "url": "https://support.microsoft.com/en-us/topic/exchange-server-2019-and-2016-august-2023-security-update-installation-fails-on-non-english-operating-systems-ef38d805-f645-4511-8cc5-cf967e5d5c75"
      },
      {
        "category": "external",
        "summary": "Microsoft Leitfaden f\u00fcr Sicherheitsupdates vom 2023-08-08",
        "url": "https://msrc.microsoft.com/update-guide"
      }
    ],
    "source_lang": "en-US",
    "title": "Microsoft Exchange Server: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2023-08-15T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:56:41.464+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-1990",
      "initial_release_date": "2023-08-08T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-08-08T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-08-10T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Informationen von Microsoft aufgenommen"
        },
        {
          "date": "2023-08-15T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates aufgenommen"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Microsoft Exchange Server 2016 Cumulative Update 23",
            "product": {
              "name": "Microsoft Exchange Server 2016 Cumulative Update 23",
              "product_id": "T023152",
              "product_identification_helper": {
                "cpe": "cpe:/a:microsoft:exchange_server_2016:cumulative_update_23"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Microsoft Exchange Server 2019 Cumulative Update 12",
                "product": {
                  "name": "Microsoft Exchange Server 2019 Cumulative Update 12",
                  "product_id": "T023151",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:exchange_server_2019:cumulative_update_12"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Microsoft Exchange Server 2019 Cumulative Update 13",
                "product": {
                  "name": "Microsoft Exchange Server 2019 Cumulative Update 13",
                  "product_id": "T028109",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:exchange_server_2019:cumulative_update_13"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Exchange Server 2019"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-38185",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 existieren mehrere Schwachstellen. Microsoft ver\u00f6ffentlicht keine Details zu den Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuf\u00fchren oder Dateien zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028109",
          "T023151",
          "T023152"
        ]
      },
      "release_date": "2023-08-08T22:00:00.000+00:00",
      "title": "CVE-2023-38185"
    },
    {
      "cve": "CVE-2023-38182",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 existieren mehrere Schwachstellen. Microsoft ver\u00f6ffentlicht keine Details zu den Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuf\u00fchren oder Dateien zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028109",
          "T023151",
          "T023152"
        ]
      },
      "release_date": "2023-08-08T22:00:00.000+00:00",
      "title": "CVE-2023-38182"
    },
    {
      "cve": "CVE-2023-38181",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 existieren mehrere Schwachstellen. Microsoft ver\u00f6ffentlicht keine Details zu den Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuf\u00fchren oder Dateien zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028109",
          "T023151",
          "T023152"
        ]
      },
      "release_date": "2023-08-08T22:00:00.000+00:00",
      "title": "CVE-2023-38181"
    },
    {
      "cve": "CVE-2023-35388",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 existieren mehrere Schwachstellen. Microsoft ver\u00f6ffentlicht keine Details zu den Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuf\u00fchren oder Dateien zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028109",
          "T023151",
          "T023152"
        ]
      },
      "release_date": "2023-08-08T22:00:00.000+00:00",
      "title": "CVE-2023-35388"
    },
    {
      "cve": "CVE-2023-35368",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 existieren mehrere Schwachstellen. Microsoft ver\u00f6ffentlicht keine Details zu den Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuf\u00fchren oder Dateien zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028109",
          "T023151",
          "T023152"
        ]
      },
      "release_date": "2023-08-08T22:00:00.000+00:00",
      "title": "CVE-2023-35368"
    },
    {
      "cve": "CVE-2023-21709",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 existieren mehrere Schwachstellen. Microsoft ver\u00f6ffentlicht keine Details zu den Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuf\u00fchren oder Dateien zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T028109",
          "T023151",
          "T023152"
        ]
      },
      "release_date": "2023-08-08T22:00:00.000+00:00",
      "title": "CVE-2023-21709"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2023-38182 (GCVE-0-2023-38182)

Solution

Solution

Tags

Sightings

Nomenclature