What is CVE-2021-24085?

CVE-2021-24085 is a security advisory published by Microsoft Security Response Center (MSRC) with High severity. Microsoft Exchange Server Spoofing Vulnerability

Which CVE IDs does CVE-2021-24085 cover?

CVE-2021-24085 covers the following CVE IDs: CVE-2021-24085. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of CVE-2021-24085?

CVE-2021-24085 has a CVSS v3 base score of 6.5, published by Microsoft Security Response Center (MSRC).

Which products are affected by CVE-2021-24085?

CVE-2021-24085 affects 4 products, including: Microsoft Exchange Server 2016 Cumulative Update 18; Microsoft Exchange Server 2016 Cumulative Update 19; Microsoft Exchange Server 2019 Cumulative Update 7; Microsoft Exchange Server 2019 Cumulative Update 8.

CVE-2021-24085HighCVSS 6.5

Microsoft Exchange Server Spoofing Vulnerability

Vendor

Microsoft Security Response Center (MSRC)

Published

February 9, 2021

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2021-24085 →

📋 Description

What is the nature of the spoofing? An authenticated attacker can leak a cert file which results in a CSRF token to be generated.

🎯 Affected products4

Microsoft Exchange Server 2016 Cumulative Update 18
Microsoft Exchange Server 2016 Cumulative Update 19
Microsoft Exchange Server 2019 Cumulative Update 7
Microsoft Exchange Server 2019 Cumulative Update 8

✅ Remediation

KB4602269 (Security Update)

🔗 References (5)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24085
patchhttps://www.microsoft.com/download/details.aspx?familyid=1a27365b-3ef6-4755-a2de-9733c1107efc
referencehttps://support.microsoft.com/help/4602269
patchhttp://www.microsoft.com/download/details.aspx?familyid=7dd6bd46-9bf2-4b1b-a7ed-69221f8225a9
patchhttp://www.microsoft.com/download/details.aspx?familyid=543dff06-10b4-4c99-b8ab-17cecbd95c33