CVE-2021-41349

MEDIUM EXPLOITED IN THE WILD NUCLEI

Microsoft Exchange Server - SSRF

Title source: llm

Description

Microsoft Exchange Server Spoofing Vulnerability

Exploits (2)

nomisec WRITEUP 5 stars
by 0xrobiul · client-side
https://github.com/0xrobiul/CVE-2021-41349
inthewild WORKING POC
poc
https://github.com/exploit-io/cve-2021-41349

Nuclei Templates (1)

Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting
MEDIUMby rootxharsh,iamnoooob
Shodan: vuln:cve-2021-26855 || http.favicon.hash:1768726119 || http.title:"outlook" || cpe:"cpe:2.3:a:microsoft:exchange_server"
FOFA: title="outlook" || icon_hash=1768726119

References (1)

Scores

CVSS v3 6.5
EPSS 0.9113
EPSS Percentile 99.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

VulnCheck KEV 2022-05-31
InTheWild.io 2022-05-31
Status published
Products (3)
microsoft/exchange_server 2013 cumulative_update_23
microsoft/exchange_server 2016 cumulative_update_21 (2 CPE variants)
microsoft/exchange_server 2019 cumulative_update_10 (2 CPE variants)
Published Nov 10, 2021
Tracked Since Feb 18, 2026