What is cve-2021-34473?

CVE-2021-34473 is a critical remote code execution vulnerability affecting Microsoft Exchange Server software. With a severity score of 9.8 (according to NIST) and 9.1 (according to Microsoft), this vulnerability poses a significant risk to systems running specific versions of Microsoft Exchange Server. This vulnerability allows attackers to execute arbitrary commands on the remote server, making it crucial for organizations to address and secure their systems against potential exploitation.

Who is impacted by this?

The CVE-2021-34473 vulnerability affects users of Microsoft Exchange Server, specifically those running versions 2013, 2016, and 2019. The impacted versions include Microsoft Exchange Server 2013 Cumulative Update 23, 2016 Cumulative Update 19 and 20, and 2019 Cumulative Update 8 and 9.

What should I do if I’m affected?

If you're affected by the CVE-2021-34473 vulnerability, it's crucial to take immediate action to secure your systems. Follow these simple steps:

1. Update your Microsoft Exchange Server to the latest version.

2. Apply security patches provided by Microsoft.

3. Regularly monitor and review logs for suspicious activity.

4. Ensure all systems have the latest security patches installed.

5. Implement strong access controls and authentication mechanisms.

6. Perform regular security audits and vulnerability assessments.

By taking these steps, you can help protect your organization from potential exploitation of this critical vulnerability.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2021-34473 vulnerability, also known as Microsoft Exchange Server Remote Code Execution Vulnerability, is indeed listed in CISA's Known Exploited Vulnerabilities Catalog. Added on November 3, 2021, organizations have until November 17, 2021.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-918, which is a Server-Side Request Forgery (SSRF) issue affecting Microsoft Exchange Server.

Learn More

For a comprehensive understanding of its description, severity, technical details, and affected software configurations, refer to the NVD page and the resources listed below.

• Microsoft Exchange ProxyShell Remote Code Execution

• Microsoft Security Update Guide - CVE-2021-34473

• ZDI-21-821 | Zero Day Initiative

• BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA