Skip to content

Microsoft Exchange Server and Windows Vulnerabilities - 20230111003

Overview

Microsoft Exchange Server - CVE-2022-41080 - contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Windows - CVE-2023-21674 - Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.

What is the vulnerability ?

CVE-2022-41080 - This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.

CVE-2023-21674 - Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability.

What is vulnerable ?

The vulnerability - CVE-2022-41080 - affects the following Microsoft Exchange Server products:

  • Microsoft Exchange Server 2013 Cumulative Update 23
  • Microsoft Exchange Server 2016 Cumulative Update 22, 23
  • Microsoft Exchange Server 2019 Cumulative Update 11, 12

The vulnerabilitiy - CVE-2023-21674 - affects the following Microsoft Servers and Windows 10 products:

  • Windows Server 2012 R2 / Server Core installation
  • Windows Server 2016 / Server Core installation
  • Windows RT 8.1 / for x64-based systems / for x32-bit Systems
  • Windows 10 Version 1607 / for x64-based systems / for x32-bit Systems
  • Windows 10 Version 22H2 / for x64-based systems / for x32-bit Systems / ARM64-based Systems
  • Windows 10 / for x64-based systems / for x32-bit Systems

Recommendation

Apply updates per vendor instructions.

Additional References