CVE-2021-33766

Warning

EPSS 93.42%
Published 14.07.2021 18:15:10
Last modified 07.03.2025 21:54:07
Source secure@microsoft.com
Teams watchlist Login
Open Login

Microsoft Exchange Server Information Disclosure Vulnerability

Affected products Warnungen 1 Metrics 4 CWE 0 References 5

Data is provided by the National Vulnerability Database (NVD)

Microsoft ≫ Exchange Server Version2013 Updatecumulative_update_23

Microsoft ≫ Exchange Server Version2016 Updatecumulative_update_19

Microsoft ≫ Exchange Server Version2016 Updatecumulative_update_20

Microsoft ≫ Exchange Server Version2019 Updatecumulative_update_8

Microsoft ≫ Exchange Server Version2019 Updatecumulative_update_9

18.01.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft Exchange Server Information Disclosure

Vulnerability

Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.

Description

Apply updates per vendor instructions.

Required actions

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	93.42%	0.998

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
secure@microsoft.com	7.3	3.9	3.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-33766

Patch

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-21-798/

Third Party Advisory

VDB Entry

https://nvd.nist.gov/vuln/detail/CVE-2021-33766

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-33766

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-33766

EUVD