CVE-2022-24477
Published: 09 August 2022
Summary
CVE-2022-24477 is a high-severity an unspecified weakness vulnerability in Microsoft Exchange Server. Its CVSS base score is 8.0 (High).
Operationally, ranked in the top 6.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Microsoft Exchange Server is affected by an elevation of privilege vulnerability tracked as CVE-2022-24477. The flaw received a CVSS 3.1 score of 8.0 with a network attack vector, low attack complexity, and low privileges required, enabling an authenticated remote attacker to achieve high impact on confidentiality, integrity, and availability.
An attacker with low-privileged access can exploit the issue over the network, subject to user interaction, to elevate privileges within the Exchange environment and potentially obtain full control over affected components.
Microsoft Security Response Center advisories at the listed update-guide URLs provide official patch information and mitigation guidance for the vulnerability. The associated EPSS score reached a peak of 0.1209 before receding to its current value of 0.0982.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-29358
Vulnerability details
Microsoft Exchange Server Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.