Vulnerability in Microsoft Exchange Server
CVE-2021-1730
<p>A spoofing vulnerability exists in Microsoft Exchange Server which could result in an attack that would allow a malicious actor to impersonate the user.</p> <p>This update addresses this vulnerability.</p> <p>To prevent these types of attacks, Microsoft recommends customers to download inline images from different DNSdomains than the rest of OWA. Please see further instructions in the FAQ to put in place this mitigations.</p>
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.018 (77.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 78th percentile — 77.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.018 · newest: 0.018 · change: 0.000
Affected products
- Microsoft Exchange Server — versions 2016, 2019
- Microsoft Exchange Server 2016 Cumulative Update 18 — versions 15.01.0
- Microsoft Exchange Server 2019 Cumulative Update 7 — versions 15.02.0
Public proof-of-concept exploits
References
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1730 (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-1730?
- CVE-2021-1730 is a medium-severity vulnerability in Microsoft Exchange Server. CVSS score: 5.4/10. Published 2021-02-25.
- How severe is CVE-2021-1730?
- Medium severity. CVSS v3 base score is 5.4 out of 10.
- Is CVE-2021-1730 known to be exploited?
- 13 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.