SB2020021147 - Privilege escalation in Microsoft Exchange Server
Published: February 11, 2020
Security Bulletin ID
SB2020021147
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-0692)
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to uspecified error in Microsoft Exchange Server. Exploitation of this vulnerability requires Exchange Web Services (EWS) to be enabled and in use in an affected environment. A remote attacker can change parameters in the Security Access Token, forward it to a Microsoft Exchange Server and impersonate an another Exchange user.
Remediation
Install update from vendor's website.