CVE-2022-41080: Microsoft Exchange Server Elevation of Privilege Vulnerability

Overview

Severity

High (CVSS 8.8)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Category

Elevation of Privilege

Exploit Status

Not Exploited

Exploitation Likelihood

More Likely

Patch Tuesday

2022-Nov

Released

2022-11-08

Last Updated

2022-12-15

EPSS Score

93.80% (percentile: 99.9%)

CISA KEV

Listed — due 2023-01-31

Known Exploits (2)

• Microsoft Exchange Server Privilege Escalation Vulnerability — added 2022-12-23T23:46:36Z
• Microsoft Exchange Server Privilege Escalation Vulnerability — added 2022-12-22T09:35:26Z

Detection & Weaponization (1 sources)

Maturity: Exploit

• GitHub PoC: 1 repositories

Affected Products (5)

Server Software

• Microsoft Exchange Server 2016 Cumulative Update 23
• Microsoft Exchange Server 2019 Cumulative Update 12
• Microsoft Exchange Server 2013 Cumulative Update 23
• Microsoft Exchange Server 2019 Cumulative Update 11
• Microsoft Exchange Server 2016 Cumulative Update 22

Security Updates (5)

• 5019758
• 5019758
• 5019758
• 5019758
• 5019758

Acknowledgments

<a href="https://twitter.com/rskvp93">rskvp93</a>, <a href="https://twitter.com/_q5ca">Q5Ca</a> and <a href="https://twitter.com/hoangnx99">nxhoang99</a> with <a href="https://lab.viettelcybersecurity.com/">VcsLab of Viettel Cyber Security</a>, <a href="https://github.com/zcgonvh">zcgonvh</a> with 360 noah lab

Revision History

• 2022-11-08: Information published.
• 2022-12-15: Added an acknowledgement. This is an informational change only.