Actively exploited · Published Feb 11, 2020 · Assigned by microsoft
CVE-2020-0688
High 8.8 Exploited Ransomware
In plain English
A high-severity improper authentication in Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30 from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Microsoft Exchange Server 2013 | Cumulative Update 23 |
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 3 | unspecified |
| Microsoft | Microsoft Exchange Server 2016 Cumulative Update 14 | unspecified |
| Microsoft | Microsoft Exchange Server 2016 Cumulative Update 15 | unspecified |
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 4 | unspecified |
| Microsoft | Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30 | unspecified |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688 x_refsource_MISC
- https://www.zerodayinitiative.com/advisories/ZDI-20-258/ x_refsource_MISC
- http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html x_refsource_MISC
- http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0688 government-resource