9.8

CVE-2019-1373

A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShell, aka 'Microsoft Exchange Remote Code Execution Vulnerability'.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Exchange Server Version 2013 Update cumulative_update_23
Microsoft ≫ Exchange Server Version 2016 Update cumulative_update_13
Microsoft ≫ Exchange Server Version 2016 Update cumulative_update_14
Microsoft ≫ Exchange Server Version 2019 Update cumulative_update_2
Microsoft ≫ Exchange Server Version 2019 Update cumulative_update_3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 18.16% 0.968
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1373
Patch
Vendor Advisory