CVE-2021-31198

Published: May 11, 2021Modified: Feb 28, 2025

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD (Secondary)

Description

Microsoft Exchange Server Remote Code Execution Vulnerability

Affected (5)

Products: Microsoft: Exchange Server

1 product

Exchange Server

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Microsoft Exchange Server	Version 2013 cumulative_update_23
Microsoft Exchange Server	Version 2016 cumulative_update_19
Microsoft Exchange Server	Version 2016 cumulative_update_20
Microsoft Exchange Server	Version 2019 cumulative_update_8
Microsoft Exchange Server	Version 2019 cumulative_update_9

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (4)

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31198

Source: secure@microsoft.com

PatchVendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-21-894/

Source: secure@microsoft.com

Third Party AdvisoryVDB Entry

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31198

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-21-894/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.