ZDI-CAN-13477: Microsoft Exchange Server ECP Authentication Bypass Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Microsoft Exchange Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authentication of requests to web services within the ecp web application. By issuing a crafted request, an attacker can bypass authentication. An attacker can leverage this vulnerability to disclose information from the server.
| Affected Software | Affected Version | How to fix |
|---|---|---|
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of ZDI-CAN-13477?
The severity of ZDI-CAN-13477 is considered critical due to the potential for remote attackers to disclose sensitive information.
How do I fix ZDI-CAN-13477?
To fix ZDI-CAN-13477, install the latest security updates provided by Microsoft for Exchange Server.
What impact does ZDI-CAN-13477 have on Microsoft Exchange Server?
ZDI-CAN-13477 allows remote attackers to access sensitive information without requiring authentication.
Are there any workarounds for ZDI-CAN-13477?
There are no effective workarounds for ZDI-CAN-13477; patching is the recommended solution.
Is ZDI-CAN-13477 publicly known?
Yes, ZDI-CAN-13477 has been publicly disclosed and detailed information is available in security advisories.
- agent/references
- agent/softwarecombine
- agent/title
- agent/severity
- agent/description
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-21-798
- alias/ZDI-CAN-13477
- alias/CVE-2021-33766
- agent/software-canonical-lookup
- agent/event
- agent/source
- agent/tags
- agent/type
- vendor/microsoft
- canonical/microsoft exchange