1. Summary
| Vulnerability Name | Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2022-41082) |
|---|---|
| Release Date | September 30, 2022 |
| Component Name | Microsoft Exchange Server |
| Affected Versions | Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2016 Cumulative Update 22 Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 11 Microsoft Exchange Server 2019 Cumulative Update 12 |
| Vulnerability Type | Remote Code Execution Vulnerability |
| Severity | CVSS v3 Base Score 8.8 (High) |
| Exploitability | Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None |
| Impact | Confidentiality Impact: High Integrity Impact: High Availability Impact: High |
2. About CVE-2022-41082
2.1 Introduction
Microsoft Exchange Server is a mail server and calendaring server developed by Microsoft. It runs exclusively on Windows Server operating systems.
2.2 Summary
CVE-2022-41082 is a zero-day remote code execution vulnerability in Microsoft Exchange Server, classified as high severity with a CVSS Score of 8.8. This vulnerability is triggered by another Exchanger Server vulnerability, CVE-2022-41040, and allows an authenticated attacker to run PowerShell on the server for remote code execution.
The two vulnerabilities have been named the ProxyNotShell vulnerabilities after the ProxyShell vulnerabilities affecting Exchange Server.
CVE-2022-41082 was added to CISA’s Known Exploited Vulnerabilities Catalog on September 30, 2022.
3. Affected Versions
Microsoft Exchange Server 2013 Cumulative Update 23
Microsoft Exchange Server 2016 Cumulative Update 22
Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft Exchange Server 2019 Cumulative Update 11
Microsoft Exchange Server 2019 Cumulative Update 12
4. Solutions
4.1 Remediation Solutions
4.1.1 Microsoft Solution
Microsoft has released a patch for affected OS versions to fix this vulnerability on November 8, 2022. Please download the patch corresponding to the affected OS from the following link: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082
5. Reference
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082
https://nvd.nist.gov/vuln/detail/CVE-2022-41082
6. Learn More
Sangfor FarSight Labs researches the latest cyberthreats and unknown zero-day vulnerabilities, alerting customers to potential dangers to their organizations, and providing real-time solutions with actionable intelligence. Sangfor FarSight Labs works with other security vendors and the security community at large to identify and verify global cyberthreats, providing fast and easy protection for customers.
