Description
Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| Microsoft Exchange Server 2013 Cumulative Update 23 | Microsoft / Microsoft Exchange Server 2013 Cumulative Update 23 | >= 15.00.0, < 15.00.1497.044 | affected |
| Microsoft Exchange Server 2016 Cumulative Update 22 | Microsoft / Microsoft Exchange Server 2016 Cumulative Update 22 | >= 15.0.0, < 15.01.2375.037 | affected |
| Microsoft Exchange Server 2016 Cumulative Update 23 | Microsoft / Microsoft Exchange Server 2016 Cumulative Update 23 | >= 15.01.0, < 15.01.2507.016 | affected |
| Microsoft Exchange Server 2019 Cumulative Update 11 | Microsoft / Microsoft Exchange Server 2019 Cumulative Update 11 | >= 15.02.0, < 15.02.0986.036 | affected |
| Microsoft Exchange Server 2019 Cumulative Update 12 | Microsoft / Microsoft Exchange Server 2019 Cumulative Update 12 | >= 15.02.0, < 15.02.1118.020 | affected |