{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Exchange Server 2013 Cumulative Update 23",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server 2016 Cumulative Update 21",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server 2016 Cumulative Update 19",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "HEVC Video Extensions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server 2019 Cumulative Update 8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Malware Protection Engine",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Power BI Report Server",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Visual Studio Code",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server 2019 Cumulative Update 10",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.14",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server 2016 Cumulative Update 20",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Bing Search pour Android",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server 2019 Cumulative Update 9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Open Enclave SDK",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-31984",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31984"
    },
    {
      "name": "CVE-2021-33777",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33777"
    },
    {
      "name": "CVE-2021-34470",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34470"
    },
    {
      "name": "CVE-2021-34528",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34528"
    },
    {
      "name": "CVE-2021-34501",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34501"
    },
    {
      "name": "CVE-2021-34464",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34464"
    },
    {
      "name": "CVE-2021-34522",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34522"
    },
    {
      "name": "CVE-2021-31947",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31947"
    },
    {
      "name": "CVE-2021-34523",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34523"
    },
    {
      "name": "CVE-2021-34479",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34479"
    },
    {
      "name": "CVE-2021-33766",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33766"
    },
    {
      "name": "CVE-2021-34452",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34452"
    },
    {
      "name": "CVE-2021-33768",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33768"
    },
    {
      "name": "CVE-2021-33767",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33767"
    },
    {
      "name": "CVE-2021-33775",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33775"
    },
    {
      "name": "CVE-2021-33778",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33778"
    },
    {
      "name": "CVE-2021-31196",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31196"
    },
    {
      "name": "CVE-2021-34469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34469"
    },
    {
      "name": "CVE-2021-31206",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31206"
    },
    {
      "name": "CVE-2021-33753",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33753"
    },
    {
      "name": "CVE-2021-33776",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33776"
    },
    {
      "name": "CVE-2021-34474",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34474"
    },
    {
      "name": "CVE-2021-34473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34473"
    },
    {
      "name": "CVE-2021-34529",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34529"
    }
  ],
  "links": [],
  "reference": "CERTFR-2021-AVI-522",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-07-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Usurpation d\u0027identit\u00e9"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es,\nune usurpation d\u0027identit\u00e9, une ex\u00e9cution de code \u00e0 distance, un\ncontournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9 et une \u00e9l\u00e9vation de\nprivil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 14 juillet 2021",
      "url": "https://msrc.microsoft.com/update-guide/"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Exchange Server 2013 Cumulative Update 23",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server 2016 Cumulative Update 21",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server 2016 Cumulative Update 19",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "HEVC Video Extensions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server 2019 Cumulative Update 8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Malware Protection Engine",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Power BI Report Server",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Visual Studio Code",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server 2019 Cumulative Update 10",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.14",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server 2016 Cumulative Update 20",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Bing Search pour Android",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Exchange Server 2019 Cumulative Update 9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Open Enclave SDK",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-31984",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31984"
    },
    {
      "name": "CVE-2021-33777",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33777"
    },
    {
      "name": "CVE-2021-34470",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34470"
    },
    {
      "name": "CVE-2021-34528",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34528"
    },
    {
      "name": "CVE-2021-34501",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34501"
    },
    {
      "name": "CVE-2021-34464",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34464"
    },
    {
      "name": "CVE-2021-34522",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34522"
    },
    {
      "name": "CVE-2021-31947",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31947"
    },
    {
      "name": "CVE-2021-34523",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34523"
    },
    {
      "name": "CVE-2021-34479",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34479"
    },
    {
      "name": "CVE-2021-33766",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33766"
    },
    {
      "name": "CVE-2021-34452",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34452"
    },
    {
      "name": "CVE-2021-33768",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33768"
    },
    {
      "name": "CVE-2021-33767",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33767"
    },
    {
      "name": "CVE-2021-33775",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33775"
    },
    {
      "name": "CVE-2021-33778",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33778"
    },
    {
      "name": "CVE-2021-31196",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31196"
    },
    {
      "name": "CVE-2021-34469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34469"
    },
    {
      "name": "CVE-2021-31206",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31206"
    },
    {
      "name": "CVE-2021-33753",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33753"
    },
    {
      "name": "CVE-2021-33776",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33776"
    },
    {
      "name": "CVE-2021-34474",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34474"
    },
    {
      "name": "CVE-2021-34473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34473"
    },
    {
      "name": "CVE-2021-34529",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34529"
    }
  ],
  "links": [],
  "reference": "CERTFR-2021-AVI-522",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-07-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Usurpation d\u0027identit\u00e9"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es,\nune usurpation d\u0027identit\u00e9, une ex\u00e9cution de code \u00e0 distance, un\ncontournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9 et une \u00e9l\u00e9vation de\nprivil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 14 juillet 2021",
      "url": "https://msrc.microsoft.com/update-guide/"
    }
  ]
}

{
  "CVSS 2.0": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Microsoft Corp",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "2013 Cumulative Update 23 (Microsoft Exchange Server), 2019 Cumulative Update 9 (Microsoft Exchange Server), 2016 Cumulative Update 20 (Microsoft Exchange Server), 2019 Cumulative Update 10 (Microsoft Exchange Server), 2016 Cumulative Update 21 (Microsoft Exchange Server)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31196",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "13.07.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "24.09.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "16.12.2021",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2021-06096",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2021-31196",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Microsoft Exchange Server",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Microsoft Exchange Server, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u0434\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0432\u0435\u0440\u043d\u043e\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u0434\u0430 (\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430) (CWE-94)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Microsoft Exchange Server \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u0434\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0418\u043d\u044a\u0435\u043a\u0446\u0438\u044f",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.cybersecurity-help.cz/vdb/SB2021071319\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31196\nhttps://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-94",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,2)"
}

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-31196",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-31196"
    }
  },
  "description": "Microsoft Exchange Server\u662fMicrosoft\u5f00\u53d1\u7684\u90ae\u4ef6\u670d\u52a1\u5668\u548c\u65e5\u5386\u670d\u52a1\u5668\u3002\n\nMicrosoft Exchange Server\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5b9e\u73b0\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31196",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-51484",
  "openTime": "2021-07-17",
  "patchDescription": "Microsoft Exchange Server\u662fMicrosoft\u5f00\u53d1\u7684\u90ae\u4ef6\u670d\u52a1\u5668\u548c\u65e5\u5386\u670d\u52a1\u5668\u3002\r\n\r\nMicrosoft Exchange Server\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5b9e\u73b0\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft Exchange Server\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CNVD-2021-51484\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Microsoft Exchange Server 2019 Cumulative Update 9",
      "Microsoft Exchange Server 2016 Cumulative Update 20",
      "Microsoft Exchange Server 2013 Cumulative Update 23",
      "Microsoft Exchange Server 2016 Cumulative Update 21",
      "Microsoft Exchange Server 2019 Cumulative Update 10"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-31196",
  "serverity": "\u4e2d",
  "submitTime": "2021-07-15",
  "title": "Microsoft Exchange Server\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CNVD-2021-51484\uff09"
}

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:*"
          ],
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2019 Cumulative Update 9",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.02.0858.015",
              "status": "affected",
              "version": "15.02.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:*"
          ],
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2016 Cumulative Update 20",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.01.2242.012",
              "status": "affected",
              "version": "15.01.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*"
          ],
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2013 Cumulative Update 23",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.00.1497.023",
              "status": "affected",
              "version": "15.00.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*"
          ],
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2016 Cumulative Update 21",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.01.2308.014",
              "status": "affected",
              "version": "15.01.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*"
          ],
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2019 Cumulative Update 10",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.02.0922.013",
              "status": "affected",
              "version": "15.02.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "secure@microsoft.com"
    }
  ],
  "cisaActionDue": "2024-09-11",
  "cisaExploitAdd": "2024-08-21",
  "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "Microsoft Exchange Server Information Disclosure Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*",
              "matchCriteriaId": "DA166F2A-D83B-4D50-AD0B-668D813E0585",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:*",
              "matchCriteriaId": "19C1EE0C-B8DD-4B91-BE4B-1C42D72FB718",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*",
              "matchCriteriaId": "3BE427A4-B0C2-4064-8234-29426325C348",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*",
              "matchCriteriaId": "B4185347-EEDD-4239-9AB3-410E2EC89D2A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:*",
              "matchCriteriaId": "71CDF29B-116B-4DE2-AFD0-B62477FF0AEB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Ejecuci\u00f3n de C\u00f3digo Remota de Microsoft Exchange Server. . Este ID de CVE es diferente de CVE-2021-31206, CVE-2021-34473"
    }
  ],
  "id": "CVE-2021-31196",
  "lastModified": "2026-06-17T03:51:25.990",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "secure@microsoft.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-31196",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-01-28T16:51:30.730018Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2021-07-14T18:15:09.463",
  "references": [
    {
      "source": "secure@microsoft.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31196"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31196"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31196"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-31196"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-14T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31206, CVE-2021-34473.",
  "id": "GHSA-5jv9-cff9-2j3m",
  "modified": "2025-10-22T00:32:18Z",
  "published": "2022-05-24T19:07:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31196"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31196"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31196"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2021-31196",
    "description": "Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31206, CVE-2021-34473.",
    "id": "GSD-2021-31196"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-31196"
      ],
      "details": "Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31206, CVE-2021-34473.",
      "id": "GSD-2021-31196",
      "modified": "2023-12-13T01:23:13.197594Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secure@microsoft.com",
        "ID": "CVE-2021-31196",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Microsoft Exchange Server 2019 Cumulative Update 9",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "15.02.0",
                          "version_value": "15.02.0858.015"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft Exchange Server 2016 Cumulative Update 20",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "15.01.0",
                          "version_value": "15.01.2242.012"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft Exchange Server 2013 Cumulative Update 23",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "15.00.0",
                          "version_value": "15.00.1497.023"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft Exchange Server 2016 Cumulative Update 21",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "15.01.0",
                          "version_value": "15.01.2308.014"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft Exchange Server 2019 Cumulative Update 10",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "15.02.0",
                          "version_value": "15.02.0922.013"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Microsoft"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Remote Code Execution"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31196",
            "refsource": "MISC",
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31196"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*",
                    "matchCriteriaId": "DA166F2A-D83B-4D50-AD0B-668D813E0585",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:*",
                    "matchCriteriaId": "19C1EE0C-B8DD-4B91-BE4B-1C42D72FB718",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*",
                    "matchCriteriaId": "3BE427A4-B0C2-4064-8234-29426325C348",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*",
                    "matchCriteriaId": "B4185347-EEDD-4239-9AB3-410E2EC89D2A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:*",
                    "matchCriteriaId": "71CDF29B-116B-4DE2-AFD0-B62477FF0AEB",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad de Ejecuci\u00f3n de C\u00f3digo Remota de Microsoft Exchange Server. . Este ID de CVE es diferente de CVE-2021-31206, CVE-2021-34473"
          }
        ],
        "id": "CVE-2021-31196",
        "lastModified": "2023-12-28T23:15:13.237",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 6.5,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 8.0,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.2,
              "impactScore": 5.9,
              "source": "secure@microsoft.com",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.2,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Secondary"
            }
          ]
        },
        "published": "2021-07-14T18:15:09.463",
        "references": [
          {
            "source": "secure@microsoft.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31196"
          }
        ],
        "sourceIdentifier": "secure@microsoft.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Microsoft Exchange Server ist das Serverprodukt f\u00fcr das Client-Server Groupware- und Nachrichtensystem der Firma Microsoft.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Microsoft Exchange Server 2013, Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 ausnutzen, um beliebigen Programmcode auszuf\u00fchren, um seine Privilegien zu erh\u00f6hen und um Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-1897 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2021/wid-sec-w-2024-1897.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-1897 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1897"
      },
      {
        "category": "external",
        "summary": "Microsoft Leitfaden f\u00fcr Sicherheitsupdates vom 2021-07-13",
        "url": "https://msrc.microsoft.com/update-guide"
      },
      {
        "category": "external",
        "summary": "Rapid7 Blog vom 2021-08-12",
        "url": "https://www.rapid7.com/blog/post/2021/08/12/proxyshell-more-widespread-exploitation-of-microsoft-exchange-servers/"
      },
      {
        "category": "external",
        "summary": "The Hacker News vom 2021-08-30",
        "url": "https://thehackernews.com/2021/08/new-microsoft-exchange-proxytoken-flaw.html"
      },
      {
        "category": "external",
        "summary": "CISA Known Exploited Vulnerabilities Catalog vom 2024-08-21",
        "url": "https://www.cisa.gov/news-events/alerts/2024/08/21/cisa-adds-four-known-exploited-vulnerabilities-catalog"
      }
    ],
    "source_lang": "en-US",
    "title": "Microsoft Exchange Server: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-08-21T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-22T08:13:42.843+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.6"
        }
      },
      "id": "WID-SEC-W-2024-1897",
      "initial_release_date": "2021-07-13T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2021-07-13T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2021-08-08T22:00:00.000+00:00",
          "number": "2",
          "summary": "Schwachstellen auch bekannt als ProxyOracle bzw. ProxyShell"
        },
        {
          "date": "2021-08-12T22:00:00.000+00:00",
          "number": "3",
          "summary": "Aktive Ausnutzung von CVE-2021-34473 und CVE-2021-34523"
        },
        {
          "date": "2021-08-30T22:00:00.000+00:00",
          "number": "4",
          "summary": "Aktive Ausnutzung von CVE-2021-33766"
        },
        {
          "date": "2024-08-21T22:00:00.000+00:00",
          "number": "5",
          "summary": "Aktive Ausnutzung von CVE-2021-31196"
        }
      ],
      "status": "final",
      "version": "5"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Cumulative Update 23",
                "product": {
                  "name": "Microsoft Exchange Server 2013 Cumulative Update 23",
                  "product_id": "T014545",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:exchange_server_2013::cumulative_update_23"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Exchange Server 2013"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Cumulative Update 20",
                "product": {
                  "name": "Microsoft Exchange Server 2016 Cumulative Update 20",
                  "product_id": "T018854",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:exchange_server_2016:cumulative_update_20"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Cumulative Update 19",
                "product": {
                  "name": "Microsoft Exchange Server 2016 Cumulative Update 19",
                  "product_id": "T019778",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:exchange_server_2016:cumulative_update_19"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Exchange Server 2016"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Cumulative Update 9",
                "product": {
                  "name": "Microsoft Exchange Server 2019 Cumulative Update 9",
                  "product_id": "T018855",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:exchange_server_2019:cumulative_update_9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Cumulative Update 8",
                "product": {
                  "name": "Microsoft Exchange Server 2019 Cumulative Update 8",
                  "product_id": "T019779",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:exchange_server_2019:cumulative_update_8"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Exchange Server 2019"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-31196",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft Exchange Server 2013, Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 existieren mehrere nicht n\u00e4her beschriebene Schwachstellen. Ein Angreifer kann dies ausnutzen, um beliebigen Code auszuf\u00fchren, um seine Privilegien zu erh\u00f6hen und um Informationen offenzulegen. Einige dieser Schwachstellen k\u00f6nnen von einem entfernten, anonymen Angreifer ausgenutzt werden. Die Ausnutzung einiger dieser Schwachstellen erfordert keine Nutzer-Interaktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T018854",
          "T019779",
          "T018855",
          "T019778",
          "T014545"
        ]
      },
      "release_date": "2021-07-13T22:00:00.000+00:00",
      "title": "CVE-2021-31196"
    },
    {
      "cve": "CVE-2021-31206",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft Exchange Server 2013, Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 existieren mehrere nicht n\u00e4her beschriebene Schwachstellen. Ein Angreifer kann dies ausnutzen, um beliebigen Code auszuf\u00fchren, um seine Privilegien zu erh\u00f6hen und um Informationen offenzulegen. Einige dieser Schwachstellen k\u00f6nnen von einem entfernten, anonymen Angreifer ausgenutzt werden. Die Ausnutzung einiger dieser Schwachstellen erfordert keine Nutzer-Interaktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T018854",
          "T019779",
          "T018855",
          "T019778",
          "T014545"
        ]
      },
      "release_date": "2021-07-13T22:00:00.000+00:00",
      "title": "CVE-2021-31206"
    },
    {
      "cve": "CVE-2021-33766",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft Exchange Server 2013, Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 existieren mehrere nicht n\u00e4her beschriebene Schwachstellen. Ein Angreifer kann dies ausnutzen, um beliebigen Code auszuf\u00fchren, um seine Privilegien zu erh\u00f6hen und um Informationen offenzulegen. Einige dieser Schwachstellen k\u00f6nnen von einem entfernten, anonymen Angreifer ausgenutzt werden. Die Ausnutzung einiger dieser Schwachstellen erfordert keine Nutzer-Interaktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T018854",
          "T019779",
          "T018855",
          "T019778",
          "T014545"
        ]
      },
      "release_date": "2021-07-13T22:00:00.000+00:00",
      "title": "CVE-2021-33766"
    },
    {
      "cve": "CVE-2021-33768",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft Exchange Server 2013, Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 existieren mehrere nicht n\u00e4her beschriebene Schwachstellen. Ein Angreifer kann dies ausnutzen, um beliebigen Code auszuf\u00fchren, um seine Privilegien zu erh\u00f6hen und um Informationen offenzulegen. Einige dieser Schwachstellen k\u00f6nnen von einem entfernten, anonymen Angreifer ausgenutzt werden. Die Ausnutzung einiger dieser Schwachstellen erfordert keine Nutzer-Interaktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T018854",
          "T019779",
          "T018855",
          "T019778",
          "T014545"
        ]
      },
      "release_date": "2021-07-13T22:00:00.000+00:00",
      "title": "CVE-2021-33768"
    },
    {
      "cve": "CVE-2021-34470",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft Exchange Server 2013, Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 existieren mehrere nicht n\u00e4her beschriebene Schwachstellen. Ein Angreifer kann dies ausnutzen, um beliebigen Code auszuf\u00fchren, um seine Privilegien zu erh\u00f6hen und um Informationen offenzulegen. Einige dieser Schwachstellen k\u00f6nnen von einem entfernten, anonymen Angreifer ausgenutzt werden. Die Ausnutzung einiger dieser Schwachstellen erfordert keine Nutzer-Interaktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T018854",
          "T019779",
          "T018855",
          "T019778",
          "T014545"
        ]
      },
      "release_date": "2021-07-13T22:00:00.000+00:00",
      "title": "CVE-2021-34470"
    },
    {
      "cve": "CVE-2021-34473",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft Exchange Server 2013, Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 existieren mehrere nicht n\u00e4her beschriebene Schwachstellen. Ein Angreifer kann dies ausnutzen, um beliebigen Code auszuf\u00fchren, um seine Privilegien zu erh\u00f6hen und um Informationen offenzulegen. Einige dieser Schwachstellen k\u00f6nnen von einem entfernten, anonymen Angreifer ausgenutzt werden. Die Ausnutzung einiger dieser Schwachstellen erfordert keine Nutzer-Interaktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T018854",
          "T019779",
          "T018855",
          "T019778",
          "T014545"
        ]
      },
      "release_date": "2021-07-13T22:00:00.000+00:00",
      "title": "CVE-2021-34473"
    },
    {
      "cve": "CVE-2021-34523",
      "notes": [
        {
          "category": "description",
          "text": "In Microsoft Exchange Server 2013, Microsoft Exchange Server 2016 und Microsoft Exchange Server 2019 existieren mehrere nicht n\u00e4her beschriebene Schwachstellen. Ein Angreifer kann dies ausnutzen, um beliebigen Code auszuf\u00fchren, um seine Privilegien zu erh\u00f6hen und um Informationen offenzulegen. Einige dieser Schwachstellen k\u00f6nnen von einem entfernten, anonymen Angreifer ausgenutzt werden. Die Ausnutzung einiger dieser Schwachstellen erfordert keine Nutzer-Interaktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T018854",
          "T019779",
          "T018855",
          "T019778",
          "T014545"
        ]
      },
      "release_date": "2021-07-13T22:00:00.000+00:00",
      "title": "CVE-2021-34523"
    }
  ]
}