CVE-2019-0724

🗓️ 06 Mar 2019 00:00:00Reported by microsoftType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 200 Views🌐 WEB

An elevation of privilege vulnerability in Microsoft Exchange Server

Reporter	Title	Published	Views	Family All 28
Information Security Automation	Vulnerability Management at Tinkoff Fintech School	4 Mar 201910:38	–	avleonov
BDU FSTEC	The vulnerability of Microsoft Exchange Server’s mail server, related to inadequate access control, allows a hacker to alter the access rights to files.	6 Mar 201900:00	–	bdu_fstec
Circl	CVE-2019-0724	18 Oct 201911:36	–	circl
Check Point Advisories	Microsoft Exchange Privilege Escalation (CVE-2019-0724)	30 Dec 201900:00	–	checkpoint_advisories
Cvelist	CVE-2019-0724	6 Mar 201900:00	–	cvelist
Microsoft KB	Cumulative Update 22 for Exchange Server 2013	12 Feb 201908:00	–	mskb
Microsoft KB	Cumulative Update 1 for Exchange Server 2019	12 Feb 201908:00	–	mskb
Microsoft KB	Cumulative Update 12 for Exchange Server 2016	12 Feb 201908:00	–	mskb
Microsoft KB	Update Rollup 26 for Exchange Server 2010 Service Pack 3	12 Feb 201908:00	–	mskb
Kaspersky	KLA11420 Multiple vulnerabilities in Microsoft Exchange Server	12 Feb 201900:00	–	kaspersky

NVD

Node

microsoft exchange_serverMatch2010sp3_rollup_26

microsoft exchange_serverMatch2013cumulative_update_22

microsoft exchange_serverMatch2016cumulative_update_12

microsoft exchange_serverMatch2019cumulative_update_1

[
  {
    "product": "Microsoft Exchange Server 2010",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "Service Pack 3 Update Rollup 26"
      }
    ]
  },
  {
    "product": "Microsoft Exchange Server 2013",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "Cumulative Update 22"
      }
    ]
  },
  {
    "product": "Microsoft Exchange Server 2016",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "Cumulative Update 12"
      }
    ]
  },
  {
    "product": "Microsoft Exchange Server 2019",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "Cumulative Update 1"
      }
    ]
  }
]

Source	Link
securityfocus	www.securityfocus.com/bid/106906
portal	www.portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0724

Parameter	Position	Path	Description
PushSubscriptionRequest	request body	/EWS/Exchange.asmx	Exploits Exchange PushSubscription to relay NTLM authentication to attacker-controlled URL.
URL	request body	/EWS/Exchange.asmx	Exploits Exchange PushSubscription to relay NTLM authentication to attacker-controlled URL.
EventTypes	request body	/EWS/Exchange.asmx	Exploits Exchange PushSubscription to relay NTLM authentication to attacker-controlled URL.
StatusFrequency	request body	/EWS/Exchange.asmx	Exploits Exchange PushSubscription to relay NTLM authentication to attacker-controlled URL.
Subscribe	request body	/EWS/Exchange.asmx	Exploits Exchange PushSubscription to relay NTLM authentication to attacker-controlled URL.
NewMailEvent	request body	/EWS/Exchange.asmx	Exploits Exchange PushSubscription to relay NTLM authentication to attacker-controlled URL.
ModifiedEvent	request body	/EWS/Exchange.asmx	Exploits Exchange PushSubscription to relay NTLM authentication to attacker-controlled URL.
MovedEvent	request body	/EWS/Exchange.asmx	Exploits Exchange PushSubscription to relay NTLM authentication to attacker-controlled URL.

17 Jun 2026 02:08Current

7.5High risk

Vulners AI Score7.5

CVSS 3.18.1

CVSS 29.3

EPSS0.23799