Exposure of Resource to Wrong Sphere in Microsoft Exchange Server - CVE-2024-21410
Published: February 13, 2024 / Updated: February 15, 2024
Vulnerability identifier: #VU86404
CSH Severity: Critical
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-21410
CWE-ID: CWE-668
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to an error in Microsoft Exchange Server. A remote attacker can target an NTLM client such as Outlook with an NTLM credentials-leaking type vulnerability. The leaked credentials can then be relayed against the Exchange server to gain privileges as the victim client and to perform operations on the Exchange server on the victim's behalf.
Note, the vulnerability is being actively exploited in the wild.
Affected software
Microsoft Exchange Server
How to mitigate CVE-2024-21410
Install updates from vendor's website.
Microsoft Exchange Server - update to 2019 CU14 2024H1 15.02.1544.004