CVE-2020-16875highobserved exploitation

Microsoft Exchange Server Remote Code Execution Vulnerability

70Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 8.4epss 47%

from disclosure to weapon123 days

Published on NVDSep 11

metasploit+123d

VulnCheck+770d

exploitation probability

47%top 1% of all CVEs

observed exploitation

yesVulnCheck

A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. Exploitation of the vulnerability requires an authenticated user in a certain Exchange role to be compromised. The security update addresses the vulnerability by correcting how Microsoft Exchange handles cmdlet arguments.

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C

Affected products

Microsoft · Microsoft Exchange Server 2016 Cumulative Update 16 Microsoft · Microsoft Exchange Server 2016 Cumulative Update 17 Microsoft · Microsoft Exchange Server 2019 Cumulative Update 5 Microsoft · Microsoft Exchange Server 2019 Cumulative Update 6

References

http://packetstormsecurity.com/files/159210/Microsoft-Exchange-Server-DlpUtils-AddTenantDlpPolicy-Remote-Code-Execution.html https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16875