2 lines
6.3 KiB
JSON
2 lines
6.3 KiB
JSON
{"affected":[{"affectedData":[{"product":"Microsoft Exchange Server 2013","vendor":"Microsoft","versions":[{"status":"affected","version":"Cumulative Update 23"}]},{"product":"Microsoft Exchange Server 2019 Cumulative Update 3","vendor":"Microsoft","versions":[{"status":"affected","version":"unspecified"}]},{"product":"Microsoft Exchange Server 2016 Cumulative Update 14","vendor":"Microsoft","versions":[{"status":"affected","version":"unspecified"}]},{"product":"Microsoft Exchange Server 2016 Cumulative Update 15","vendor":"Microsoft","versions":[{"status":"affected","version":"unspecified"}]},{"product":"Microsoft Exchange Server 2019 Cumulative Update 4","vendor":"Microsoft","versions":[{"status":"affected","version":"unspecified"}]},{"product":"Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30","vendor":"Microsoft","versions":[{"status":"affected","version":"unspecified"}]}],"source":"secure@microsoft.com"}],"cisaActionDue":"2022-05-03","cisaExploitAdd":"2021-11-03","cisaRequiredAction":"Apply updates per vendor instructions.","cisaVulnerabilityName":"Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability","configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup_30:*:*:*:*:*:*","matchCriteriaId":"276776E0-F9DA-4F18-A984-5E7811465B80","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*","matchCriteriaId":"DA166F2A-D83B-4D50-AD0B-668D813E0585","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*","matchCriteriaId":"55284CF7-0D04-4216-83FE-4B1F9CA94207","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*","matchCriteriaId":"CA2CE223-AA49-49E6-AC32-59270EFF55AD","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*","matchCriteriaId":"104F96DC-E280-4E0A-8586-B043B55888C2","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*","matchCriteriaId":"73B3B3FE-7E85-4B86-A983-2C410FFEF4B8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'."},{"lang":"es","value":"Se presenta una vulnerabilidad de ejecución de código remota en el software Microsoft Exchange cuando el software no puede manejar apropiadamente los objetos en la memoria, también se conoce como \"Microsoft Exchange Memory Corruption Vulnerability\"."}],"id":"CVE-2020-0688","lastModified":"2026-06-17T02:46:21.387","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"COMPLETE","baseScore":9.0,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","version":"2.0"},"exploitabilityScore":8.0,"impactScore":10.0,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2020-0688","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-02-04T18:44:23.710392Z","version":"2.0.3"}}]},"published":"2020-02-11T22:15:15.900","references":[{"source":"secure@microsoft.com","tags":["Exploit","Third Party Advisory","VDB Entry"],"url":"http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html"},{"source":"secure@microsoft.com","tags":["Exploit","Third Party Advisory","VDB Entry"],"url":"http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html"},{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688"},{"source":"secure@microsoft.com","tags":["Third Party Advisory","VDB Entry"],"url":"https://www.zerodayinitiative.com/advisories/ZDI-20-258/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"],"url":"http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"],"url":"http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"url":"https://www.zerodayinitiative.com/advisories/ZDI-20-258/"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0688"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
|