CVE-2023-21710 - Vulnerability Details - OpenCVE

Description

Microsoft Exchange Server Remote Code Execution Vulnerability

Published: 2023-02-14

Score: 7.2 High

EPSS: 4.7% Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Microsoft Exchange Server 2016 Cumulative Update 23

affected

Version	Status	Constraints
`15.01.0`	affected	< 15.01.2507.021

Microsoft

Microsoft Exchange Server 2019 Cumulative Update 11

affected

Version	Status	Constraints
`15.02.0`	affected	< 15.02.0986.041

Microsoft

Microsoft Exchange Server 2019 Cumulative Update 12

affected

Version	Status	Constraints
`15.02.0`	affected	< 15.02.1118.025

Configuration 1 [-]

OR	cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23::::::
	cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11::::::
	cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12::::::

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2023-25877	Microsoft Exchange Server Remote Code Execution Vulnerability

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.04726.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21710

History

Tue, 04 Mar 2025 03:45:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Subscriptions

Microsoft Exchange Server

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2023-02-14T19:33:41.835Z

Updated: 2025-02-28T21:14:01.338Z

Reserved: 2022-12-13T18:08:03.490Z

Link: CVE-2023-21710

Vulnrichment

Updated: 2024-08-02T09:44:02.107Z

NVD

Status : Modified

Published: 2023-02-14T20:15:14.050

Modified: 2024-11-21T07:43:29.213

Link: CVE-2023-21710

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-21710", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2022-12-13T18:08:03.490Z", "datePublished": "2023-02-14T19:33:41.835Z", "dateUpdated": "2025-02-28T21:14:01.338Z"}, "containers": {"cna": {"title": "Microsoft Exchange Server Remote Code Execution Vulnerability", "datePublic": "2023-02-14T08:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_23:*:*:*:*:*:*", "versionStartIncluding": "15.01.0", "versionEndExcluding": "15.01.2507.021"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_11:*:*:*:*:*:*", "versionStartIncluding": "15.02.0", "versionEndExcluding": "15.02.0986.041"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_12:*:*:*:*:*:*", "versionStartIncluding": "15.02.0", "versionEndExcluding": "15.02.1118.025"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Exchange Server 2016 Cumulative Update 23", "platforms": ["x64-based Systems"], "versions": [{"version": "15.01.0", "lessThan": "15.01.2507.021", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Exchange Server 2019 Cumulative Update 11", "platforms": ["x64-based Systems"], "versions": [{"version": "15.02.0", "lessThan": "15.02.0986.041", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Exchange Server 2019 Cumulative Update 12", "platforms": ["x64-based Systems"], "versions": [{"version": "15.02.0", "lessThan": "15.02.1118.025", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Microsoft Exchange Server Remote Code Execution Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-502: Deserialization of Untrusted Data", "lang": "en-US", "type": "CWE", "cweId": "CWE-502"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-01-01T00:41:16.649Z"}, "references": [{"name": "Microsoft Exchange Server Remote Code Execution Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21710"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T09:44:02.107Z"}, "title": "CVE Program Container", "references": [{"name": "Microsoft Exchange Server Remote Code Execution Vulnerability", "tags": ["vendor-advisory", "x_transferred"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21710"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-28T20:23:16.119377Z", "id": "CVE-2023-21710", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-28T21:14:01.338Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-21710", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2022-12-13T18:08:03.490Z", "datePublished": "2023-02-14T19:33:41.835Z", "dateUpdated": "2025-02-28T21:14:01.338Z"}, "containers": {"cna": {"title": "Microsoft Exchange Server Remote Code Execution Vulnerability", "datePublic": "2023-02-14T08:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_23:*:*:*:*:*:*", "versionStartIncluding": "15.01.0", "versionEndExcluding": "15.01.2507.021"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_11:*:*:*:*:*:*", "versionStartIncluding": "15.02.0", "versionEndExcluding": "15.02.0986.041"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_12:*:*:*:*:*:*", "versionStartIncluding": "15.02.0", "versionEndExcluding": "15.02.1118.025"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Exchange Server 2016 Cumulative Update 23", "platforms": ["x64-based Systems"], "versions": [{"version": "15.01.0", "lessThan": "15.01.2507.021", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Exchange Server 2019 Cumulative Update 11", "platforms": ["x64-based Systems"], "versions": [{"version": "15.02.0", "lessThan": "15.02.0986.041", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Exchange Server 2019 Cumulative Update 12", "platforms": ["x64-based Systems"], "versions": [{"version": "15.02.0", "lessThan": "15.02.1118.025", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Microsoft Exchange Server Remote Code Execution Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-502: Deserialization of Untrusted Data", "lang": "en-US", "type": "CWE", "cweId": "CWE-502"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-01-01T00:41:16.649Z"}, "references": [{"name": "Microsoft Exchange Server Remote Code Execution Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21710"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T09:44:02.107Z"}, "title": "CVE Program Container", "references": [{"name": "Microsoft Exchange Server Remote Code Execution Vulnerability", "tags": ["vendor-advisory", "x_transferred"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21710"}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-21710", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-28T20:23:16.119377Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-28T20:23:17.496Z"}}]}}