BDU:2021-01123
Scores
EPSS Score
0.0000
CVSS
3.x 9.8
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
All CVSS Scores
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Description
Уязвимость почтового сервера Microsoft Exchange Server связана с недостаточной проверкой поступающих запросов. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, осуществить SSRF-атаку с помощью специально сформированных HTTPS-запросов (содержащих вредоносные файлы cookie X-AnonResource-Backend и искаженные файлы cookie X-BEResource)
Sources
Related Vulnerabilities
Reference Links
Vulnerable Software
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2019 Cumulative Update 1"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2013 Cumulative Update 22"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2019 Cumulative Update 4"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2016 Cumulative Update 15"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2019 Cumulative Update 2"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2016 Cumulative Update 13"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2016 Cumulative Update 19"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2016 Cumulative Update 12"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2019 Cumulative Update 8"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2019 Cumulative Update 7"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2019 Cumulative Update 5"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2016 Cumulative Update 16"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2019 Cumulative Update 3"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2019"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2013 Cumulative Update 21"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2016 Cumulative Update 9"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2016 Cumulative Update 18"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2019 Cumulative Update 6"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2016 Cumulative Update 17"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2013 Cumulative Update 23"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2016 Cumulative Update 11"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2016 Cumulative Update 10"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2016 Cumulative Update 8"
}Source: bdu
Type: Configuration
Vendor: microsoft corp.
Product: microsoft exchange server
Operating System: * *
{
"version_exact": "2016 Cumulative Update 14"
}Source: bdu