CVE-2020-16875

Microsoft Exchange Server Remote Code Execution Vulnerability

State
Published
Severity
8.4 High
Published
Sep 11, 2020
Updated
Aug 4, 2024
Reserved
Aug 4, 2020

Read the record on cve.org

Description

<p>A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.</p> <p>An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. Exploitation of the vulnerability requires an authenticated user in a certain Exchange role to be compromised.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Exchange handles cmdlet arguments.</p>

Scores

CVSSScoreVectorSource
3.18.4 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:Cmicrosoft

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
Microsoft Exchange Server 2019 Cumulative Update 5Microsoft
  • 15.02.0 to before publicationAffected
Microsoft Exchange Server 2019 Cumulative Update 6Microsoft
  • 15.02.0 to before publicationAffected
Microsoft Exchange Server 2016 Cumulative Update 16Microsoft
  • 15.01.0 to before publicationAffected
Microsoft Exchange Server 2016 Cumulative Update 17Microsoft
  • 15.01.0 to before publicationAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.