Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA12224
HistoryJul 13, 2021 - 12:00 a.m.

KLA12224 Multiple vulnerabilities in Microsoft Exchange Server

2021-07-1300:00:00
Kaspersky Lab
threats.kaspersky.com
86

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

10 High

AI Score

Confidence

High

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.973 High

EPSS

Percentile

99.9%

JSON

Detect date:

07/13/2021

Severity:

Critical

Description:

Multiple vulnerabilities were found in Microsoft Exchange Server. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, obtain sensitive information.

Exploitation:

Public exploits exist for this vulnerability.

Affected products:

Microsoft Exchange Server 2019 Cumulative Update 10
Microsoft Exchange Server 2019 Cumulative Update 9
Microsoft Exchange Server 2013 Cumulative Update 23
Microsoft Exchange Server 2016 Cumulative Update 20
Microsoft Exchange Server 2019 Cumulative Update 8
Microsoft Exchange Server 2016 Cumulative Update 19
Microsoft Exchange Server 2016 Cumulative Update 21

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2021-31196
CVE-2021-34470
CVE-2021-31206
CVE-2021-34473
CVE-2021-34523
CVE-2021-33766
CVE-2021-33768

Impacts:

ACE

Related products:

Microsoft Exchange Server

CVE-IDS:

CVE-2021-311967.2High
CVE-2021-344708.0Critical
CVE-2021-312067.6Critical
CVE-2021-344739.1Critical
CVE-2021-345239.0Critical
CVE-2021-337667.3High
CVE-2021-337688.0Critical

KB list:

5001779
5004780
5004778
5004779
5003611
5003612

Microsoft official advisories:

References

Related

nessus 2
mskb 6
attackerkb 5
nuclei 1
msrc 2
avleonov 3
qualysblog 8
ics 5
checkpoint_advisories 2
hivepro 8
packetstorm 1
githubexploit 10
malwarebytes 7
pentestpartners 1
cisa 2
thn 11
threatpost 17
rapid7blog 6
fireeye 1
zdt 1
metasploit 1
trellix 4
prion 7
cve 7
cvelist 7
mscve 7
zdi 4
cisa_kev 3
securelist 3
mmpc 2
seebug 1
krebs 1
impervablog 1
mssecure 1
nessus
nessus
Security Updates for Exchange (July 2021)
2021-07-15 00:00:00
Security Updates for Microsoft Exchange Server (April 2021)
2021-04-13 00:00:00
mskb
mskb
Description of the security update for Microsoft Exchange Server 2016: July 13, 2021 (KB5004779)
2021-07-13 07:00:00
Description of the security update for Microsoft Exchange Server 2019: July 13, 2021 (KB5004780)
2021-07-13 07:00:00
Description of the security update for Microsoft Exchange Server 2013: July 13, 2021 (KB5004778)
2021-07-13 07:00:00
attackerkb
attackerkb
CVE-2021-31206
2021-07-14 00:00:00
CVE-2021-34473
2021-07-14 00:00:00
CVE-2021-34523
2021-07-14 00:00:00
nuclei
nuclei
Exchange Server - Remote Code Execution
2021-08-10 07:59:06
msrc
msrc
April 2021 Update Tuesday packages now available
2021-04-13 07:00:00
April 2021 Update Tuesday packages now available
2021-04-13 07:00:00
avleonov
avleonov
Security News: Exchange ProxyShell, Zoom RCE, Citrix Canceled PT Acknowledgments, Cisco No Patch Router RCEs
2021-08-31 23:16:51
Vulnerability Management news and publications #2
2022-08-14 11:30:44
Vulristics Microsoft Patch Tuesday July 2021: Zero-days EoP in Kernel and RCE in Scripting Engine, RCEs in Kernel, DNS Server, Exchange and Hyper-V
2021-07-14 21:00:27
qualysblog
qualysblog
AvosLocker Ransomware Behavior Examined on Windows & Linux
2022-03-07 05:18:46
Qualys Tackles 2022’s Top Routinely Exploited Cyber Vulnerabilities
2023-08-24 19:07:05
In-Depth Look Into Data-Driven Science Behind Qualys TruRisk
2022-10-10 14:32:29
ics
ics
Iranian Islamic Revolutionary Guard Corps-Affiliated Cyber Actors Exploiting Vulnerabilities for Data Extortion and Disk Encryption for Ransom Operations
2022-09-14 12:00:00
#StopRansomware: Hive Ransomware
2022-11-25 12:00:00
Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities
2021-11-19 12:00:00
checkpoint_advisories
checkpoint_advisories
Microsoft Exchange Server Remote Code Execution (CVE-2021-34473; CVE-2021-34523)
2021-07-14 00:00:00
Microsoft Exchange Information Disclosure (CVE-2021-33766)
2021-09-05 00:00:00
hivepro
hivepro
AvosLocker Ransomware group has targeted 50+ Organizations Worldwide
2022-03-24 06:30:44
BlackByte ransomware exploits Microsoft Servers ProxyShell Vulnerabilities
2021-12-07 13:24:49
Magic Hound Exploiting Old Microsoft Exchange ProxyShell Vulnerabilities
2022-03-25 04:05:09
packetstorm
packetstorm
Microsoft Exchange ProxyShell Remote Code Execution
2021-08-20 00:00:00
githubexploit
githubexploit
Exploit for Vulnerability in Microsoft
2021-10-02 07:29:24
Exploit for Improper Authentication in Microsoft
2021-08-31 22:03:13
Exploit for Improper Authentication in Microsoft
2021-09-15 09:09:20
malwarebytes
malwarebytes
Patch now! Microsoft Exchange is being attacked via ProxyShell
2021-08-23 13:21:08
IIS extensions are on the rise as backdoors to servers
2022-07-27 13:58:06
AvosLocker ransomware uses Microsoft Exchange Server vulnerabilities, says FBI
2022-03-21 21:09:12
pentestpartners
pentestpartners
Hive Ransomware is on the rise. How should you deal with it?
2022-11-18 06:44:42
cisa
cisa
Urgent: Protect Against Active Exploitation of ProxyShell Vulnerabilities
2021-08-21 00:00:00
CISA Adds 13 Known Exploited Vulnerabilities to Catalog
2022-01-18 00:00:00
thn
thn
WARNING: Microsoft Exchange Under Attack With ProxyShell Flaws
2021-08-22 09:51:00
New Incident Report Reveals How Hive Ransomware Targets Organizations
2022-04-21 10:00:00
Hackers Exploiting ProxyLogon and ProxyShell Flaws in Spam Campaigns
2021-11-22 11:47:00
threatpost
threatpost
Microsoft Breaks Silence on Barrage of ProxyShell Attacks
2021-08-26 12:39:54
IKEA Hit by Email Reply-Chain Cyberattack
2021-11-29 21:22:12
Attackers Hijack Email Using Proxy Logon/Proxyshell Flaws
2021-11-22 19:26:25
rapid7blog
rapid7blog
For Microsoft Exchange Server Vulnerabilities, Patching Remains Patchy
2021-10-06 14:07:12
ProxyShell: More Widespread Exploitation of Microsoft Exchange Servers
2021-08-12 21:08:43
Metasploit Wrap-Up
2021-08-20 19:12:00
fireeye
fireeye
PST, Want a Shell? ProxyShell Exploiting Microsoft Exchange Servers
2021-09-03 10:00:00
zdt
zdt
Microsoft Exchange ProxyShell Remote Code Execution Exploit
2021-08-21 00:00:00
metasploit
metasploit
Microsoft Exchange ProxyShell RCE
2021-08-18 14:50:34
trellix
trellix
Trellix Global Defenders: Analysis and Protections for BlackByte Ransomware
2022-02-28 00:00:00
Trellix Global Defenders: Analysis and Protections for BlackByte Ransomware
2022-02-28 00:00:00
The Bug Report October 2022 Edition
2022-11-02 00:00:00
prion
prion
Privilege escalation
2021-07-14 18:15:00
Remote code execution
2021-07-14 18:15:00
Remote code execution
2021-07-14 18:15:00
cve
cve
CVE-2021-33766
2021-07-14 18:15:00
CVE-2021-31196
2021-07-14 18:15:00
CVE-2021-33768
2021-07-14 18:15:00
cvelist
cvelist
CVE-2021-31196 Microsoft Exchange Server Remote Code Execution Vulnerability
2021-07-14 17:53:12
CVE-2021-31206 Microsoft Exchange Server Remote Code Execution Vulnerability
2021-07-14 17:53:13
CVE-2021-33768 Microsoft Exchange Server Elevation of Privilege Vulnerability
2021-07-14 17:53:42
mscve
mscve
Microsoft Exchange Server Remote Code Execution Vulnerability
2021-07-13 07:00:00
Microsoft Exchange Server Elevation of Privilege Vulnerability
2021-07-13 07:00:00
Microsoft Exchange Server Remote Code Execution Vulnerability
2021-07-13 07:00:00
zdi
zdi
Microsoft Exchange Server ECP Authentication Bypass Information Disclosure Vulnerability
2021-07-15 00:00:00
(Pwn2Own) Microsoft Exchange Server CabUtility ExtractCab Directory Traversal Remote Code Execution Vulnerability
2021-07-19 00:00:00
(Pwn2Own) Microsoft Exchange Server PowerShell Improper Authentication Remote Code Execution Vulnerability
2021-07-19 00:00:00
cisa_kev
cisa_kev
Microsoft Exchange Server Information Disclosure
2022-01-18 00:00:00
Microsoft Exchange Server Privilege Escalation Vulnerability
2021-11-03 00:00:00
Microsoft Exchange Server Remote Code Execution Vulnerability
2021-11-03 00:00:00
securelist
securelist
CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange
2022-12-19 16:15:49
IT threat evolution in Q3 2021. PC statistics
2021-11-26 12:00:36
From Caribbean shores to your devices: analyzing Cuba ransomware
2023-09-11 10:00:26
mmpc
mmpc
The five-day job: A BlackByte ransomware intrusion case study
2023-07-06 17:00:00
Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability
2021-12-12 05:29:03
seebug
seebug
Exchange ProxyOracle 信息泄露漏洞利用链（CVE-2021-31195、 CVE-2021-31196）
2021-08-17 00:00:00
krebs
krebs
Microsoft Patch Tuesday, July 2021 Edition
2021-07-13 21:41:47
impervablog
impervablog
Microsoft Exchange Server Vulnerabilities CVE-2022-41040 and CVE-2022-41082
2022-09-30 16:47:34
mssecure
mssecure
Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability
2021-12-12 05:29:03

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

10 High

AI Score

Confidence

High

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.973 High

EPSS

Percentile

99.9%

JSON
Related for KLA12224
nessus2mskb6attackerkb5nuclei1msrc2avleonov3qualysblog8ics5checkpoint_advisories2hivepro8packetstorm1githubexploit10malwarebytes7pentestpartners1cisa2thn11threatpost17rapid7blog6fireeye1zdt1metasploit1trellix4prion7cve7cvelist7mscve7zdi4cisa_kev3securelist3mmpc2seebug1krebs1impervablog1mssecure1