Main Vulnerability Database Vulnerabilities #VU17228

Improper access control in Microsoft Exchange Server - CVE-2019-0686

Published: January 27, 2019 / Updated: February 12, 2019

Vulnerability identifier: #VU17228

CSH Severity: Medium

CVSS v4: 9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]

CVE-ID: CVE-2019-0686

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote authenticated user to gain escalated privileges.

The vulnerability exists due to improper access restrictions when processing requests to the "/privexchange" API endpoint. A remote authenticated user with limited privileges and mailbox access can gain DCSync privileges and obtain hashed passwords of all Active Directory users.

Successful exploitation of the vulnerability may allow an attacker to gain full access to the Active Directory infrastructure.

Affected software

Microsoft Exchange Server

How to mitigate CVE-2019-0686

On February 5, 2019 Microsoft has issued a workaround to address this vulnerability.

On February 11 the official patch was released to address this vulnerability.

Microsoft Exchange Server - addressed in versions 2010 Service Pack 3 Update Rollup 26, 2013 Cumulative Update 22 15.00.1473.003, 2016 Cumulative Update 12 15.01.1713.005, 2019 Cumulative Update 1 15.02.0330.005

External References

Related Security Bulletins