CVE-2022-21980
Published: 09 August 2022
Summary
CVE-2022-21980 is a high-severity an unspecified weakness vulnerability in Microsoft Exchange Server. Its CVSS base score is 8.0 (High).
Operationally, ranked in the top 6.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Microsoft Exchange Server is affected by an elevation of privilege vulnerability tracked as CVE-2022-21980. The flaw permits an attacker to obtain higher privileges on the server, with a CVSS 3.1 base score of 8.0 reflecting network attack vector, low attack complexity, low required privileges, and required user interaction.
An authenticated remote attacker with low privileges can exploit the issue over the network. Successful exploitation grants the ability to read, modify, or delete data with high impact to confidentiality, integrity, and availability on the targeted Exchange Server.
Microsoft security advisories at the referenced MSRC update guide page describe available patches and mitigation steps for the vulnerability.
The EPSS score rose from a low baseline to a recorded peak of 0.1570 before settling at the current value of 0.1012, indicating that exploitation interest increased after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-27135
Vulnerability details
Microsoft Exchange Server Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.