Microsoft Exchange Server Tampering Vulnerability

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• microsoft exchange server2016
• microsoft exchange server2019
• microsoft exchange server subscription editionbefore 15.02.2562.049

Versions reported by the vendor

Affected version ranges reported by the assigning authority (microsoft). Independent of NVD's CPE analysis and usually ahead of it.

• Microsoft Microsoft Exchange Server 2016 Cumulative Update 23

  • 15.01.0.0 and later · before 15.01.2507.073affected

• Microsoft Microsoft Exchange Server 2019 Cumulative Update 14

  • 15.02.0.0 and later · before 15.02.1544.046affected

• Microsoft Microsoft Exchange Server 2019 Cumulative Update 15

  • 15.02.0.0 and later · before 15.02.1748.051affected

• Microsoft Microsoft Exchange Server Subscription Edition RTM

  • 15.02.0.0 and later · before 15.02.2562.049affected

Other highest-scoring records for the same primary product.

• CVE-2021-34523Microsoft Exchange Server Elevation of Privilege VulnerabilityKEV
  96Now
• CVE-2021-34473Microsoft Exchange Server Remote Code Execution VulnerabilityKEV
  96Now
• CVE-2021-26855Microsoft Exchange Server Remote Code Execution VulnerabilityKEV
  96Now
• CVE-2022-41040Microsoft Exchange Server Elevation of Privilege VulnerabilityKEV
  95Now
• CVE-2020-0688A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, akKEV
  95Now
• CVE-2021-42321Microsoft Exchange Server Remote Code Execution VulnerabilityKEV
  93Now

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The endpoint fetches the record by the ID sent in the request, but never checks whether the record belongs to the requesting user.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const invoice = await Invoice.findById(req.params.id);2res.json(invoice);

1const invoice = await Invoice.findOne({2  id: req.params.id,3  ownerId: req.user.id,4});5if (!invoice) return res.sendStatus(404);6res.json(invoice);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.