CVE-2021-33766: high-severity vulnerability in Microsoft Exchange Server 2013 Cumulative…
Microsoft Exchange Server Information Disclosure Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply updates per vendor instructions.
A security flaw in Microsoft Exchange Server allows attackers to read sensitive information like emails and calendar data without proper authentication. This happens through a weakness in how the server handles certain requests.
This vulnerability permits unauthenticated attackers to disclose sensitive information stored on Exchange Server instances through an improper input validation flaw in the server's request handling mechanism. The attack requires network access to the affected Exchange service and can result in unauthorized access to mailbox contents, calendar data, and other confidential information without requiring valid credentials.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.