Skip to main content

Exchange Server CVE-2021-41348

HIGH
Improper Privilege Management (CWE-269)
2021-10-13 secure@microsoft.com
Microsoft Privilege Escalation Exchange Server
8.0
CVSS 3.1 · Vendor: microsoft
Share

Severity by source

Vendor (microsoft) PRIMARY
8.0 HIGH
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Oct 13, 2021 - 01:15 cve.org
HIGH 8.0

DescriptionCVE.org

Microsoft Exchange Server Elevation of Privilege Vulnerability

AnalysisAI

Microsoft Exchange Server Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.

Technical ContextAI

This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. Microsoft Exchange Server Elevation of Privilege Vulnerability Affected products include: Microsoft Exchange Server.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply principle of least privilege, validate privilege transitions, implement proper role separation.

More in Exchange Server

View all
CVE-2021-34473 CRITICAL POC
9.1 Jul 14

Microsoft Exchange Server contains a pre-authentication SSRF vulnerability known as 'ProxyShell' that allows unauthentic
CVE-2021-26855 CRITICAL POC
9.1 Mar 03

Microsoft Exchange Server contains a server-side request forgery (SSRF) vulnerability known as 'ProxyLogon' that allows

CVE-2021-34523 CRITICAL POC
9.0 Jul 14

Microsoft Exchange Server contains a privilege escalation vulnerability in the PowerShell backend that allows authentica
CVE-2021-27065 HIGH POC
7.8 Mar 03

Microsoft Exchange Server allows post-authentication arbitrary file write that enables web shell deployment, the primary
CVE-2021-42321 HIGH POC
8.8 Nov 10

Microsoft Exchange Server Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is rem
CVE-2021-33766 HIGH POC
7.3 Jul 14

Microsoft Exchange Server Information Disclosure Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is re
CVE-2022-41080 HIGH
8.8 Nov 09

Microsoft Exchange Server Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-26858 HIGH
7.8 Mar 03

Microsoft Exchange Server allows authenticated attackers to write arbitrary files to the server filesystem, the third co
CVE-2023-21529 HIGH POC
8.8 Feb 14

Remote code execution in Microsoft Exchange Server 2013, 2016, and 2019 allows authenticated attackers to execute arbitr
CVE-2021-41349 MEDIUM POC
6.5 Nov 10

Microsoft Exchange Server Spoofing Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely explo
CVE-2021-26857 HIGH
7.8 Mar 03

Microsoft Exchange Server Unified Messaging service contains a deserialization vulnerability that allows authenticated a
CVE-2021-31196 HIGH
7.2 Jul 14

Microsoft Exchange Server Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is rem

Same weakness CWE-269 – Improper Privilege Management

View all
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2012-3993 CRITICAL POC
9.3
CVE-2017-11467 CRITICAL POC
9.8
CVE-2014-1510 CRITICAL POC
9.8
CVE-2014-1511 CRITICAL POC
9.8
CVE-2019-1405 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Share

CVE-2021-41348 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy