CVE-2020-16875

HIGHRansomware

Microsoft Exchange Server Remote Code Execution Vulnerability

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-16875 has a selected CVSS score of 8.4 (high); EIP currently links 1 catalogued exploit. VulnCheck reports CVE-2020-16875 use in known ransomware campaigns.

Description

A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user, aka 'Microsoft Exchange Server Remote Code Execution Vulnerability'.

Description source: GitHub Advisory

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Oct 21, 2022 · VulnCheck
Reported exploitation
Observed · VulnCheck
Ransomware use
Observed · VulnCheck

Available material

Catalogued exploits
1

Affected products and versions

5
ProductSourceVersion range

Exchange Server

Browse Microsoft / Exchange Server
VulnCheckVersion data not supplied

Microsoft Exchange Server 2016 Cumulative Update 16

Browse Microsoft / Microsoft Exchange Server 2016 Cumulative Update 16
CVE List15.01.0 to < publicationaffected

Microsoft Exchange Server 2016 Cumulative Update 17

Browse Microsoft / Microsoft Exchange Server 2016 Cumulative Update 17
CVE List15.01.0 to < publicationaffected

Microsoft Exchange Server 2019 Cumulative Update 5

Browse Microsoft / Microsoft Exchange Server 2019 Cumulative Update 5
CVE List15.02.0 to < publicationaffected

Microsoft Exchange Server 2019 Cumulative Update 6

Browse Microsoft / Microsoft Exchange Server 2019 Cumulative Update 6
CVE List15.02.0 to < publicationaffected

Proofs of concept

1

Catalogued exploits

MetasploitMicrosoft Exchange Server DlpUtils AddTenantDlpPolicy RCEMetasploit exploitby Leonard Rapp +5 moreNot analyzed1 file

Ruby · linked to 2 vulnerabilities

Metasploit
PoC details

References

3