Microsoft Exchange Server Spoofing Vulnerability

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2021-41349, CVE-2021-42305)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-42321)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Microsoft Exchange Server versions 2019 before cumulative update 11, 2016 before cumulative update 22 and 2013 before cumulative update 23 are affected by a cross-site scripting vulnerability through the `autodiscover/autodiscover.json` endpoint. By crafting a specific URL, an attacker could target any Exchange user and try conducting phishing attacks or performing arbitrary modification on the target application.

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2021-41349, CVE-2021-42305)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-42321)

ID	Name	Product	Family	Severity
155962	Security Updates for Exchange (November 2021) (Remote)	Nessus	Windows	high
113057	Microsoft Exchange Server Autodiscover Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
154999	Security Updates for Exchange (November 2021)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2021-41349

medium

Tenable Plugins

high

medium

high