CVE Vulnerability Advisory Database

Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.

Showing 1–1 of 1 advisories (Page 1/1)

CVE-2022-410408.8/HIGHEPSS 100.0%CISA KEV

2022-10-03

Microsoft Exchange Server Elevation of Privilege and SSRF Vulnerability (CVE-2022-41040, ProxyNotShell) Security Advisory

[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019 On-Premises environments

[Impact] Authenticated attackers can exploit this SSRF vulnerability to access backend APIs, leading to Remote Code Execution (RCE) and complete system compromise

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or implement IIS URL Rewrite rules as a temporary workaround

cve-2022-41040 proxynotshell ssrf cwe-918 elevation-of-privilege

Full Advisory & Mitigation