nvd.nist.gov Open in urlscan Pro
2600:1f18:268d:1d01:f609:5e91:8a48:f546  Public Scan

Form analysis
0 forms found in the DOM

Text Content

YOU ARE VIEWING THIS PAGE IN AN UNAUTHORIZED FRAME WINDOW.

This is a potential security issue, you are being redirected to
https://nvd.nist.gov

NVD MENU
 * General Expand or Collapse
   
   NVD Dashboard
   
   News
   
   Email List
   
   FAQ
   
   Visualizations

 * Vulnerabilities Expand or Collapse
   
   Search & Statistics
   
   Full Listing
   
   Categories
   
   Data Feeds
   
   Vendor Comments
   
   CVMAP

 * Vulnerability Metrics Expand or Collapse
   
   CVSS V3 Calculator
   
   CVSS V2 Calculator
   
   
 * Products Expand or Collapse
   
   CPE Dictionary
   
   CPE Search
   
   CPE Statistics
   
   SWID
   
   
 * Developers Expand or Collapse
   
   Start Here
   
   Request an API Key
   
   Vulnerabilities
   
   Products
   
   Terms of Use

 * Contact NVD
 * Other Sites Expand or Collapse
   
   Checklist (NCP) Repository
   
   Configurations (CCE)
   
   800-53 Controls
   
   SCAP Validated Tools
   
   SCAP
   
   USGCB

 * Search Expand or Collapse
   
   Vulnerability Search
   
   CPE Search


INFORMATION TECHNOLOGY LABORATORY


NATIONAL VULNERABILITY DATABASE


NATIONAL VULNERABILITY DATABASE


NVD


 1. Vulnerabilities


CVE-2021-42321 DETAIL


CURRENT DESCRIPTION

Microsoft Exchange Server Remote Code Execution Vulnerability


View Analysis Description


ANALYSIS DESCRIPTION

Microsoft Exchange Server Remote Code Execution Vulnerability


SEVERITY

 
CVSS Version 3.x CVSS Version 2.0


CVSS 3.x Severity and Metrics:


NIST: NVD
Base Score:  8.8 HIGH
Vector:  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H


NVD Analysts use publicly available information to associate vector strings and
CVSS scores. We also display any CVSS information provided within the CVE List
from the CNA.

Note: NVD Analysts have published a CVSS score for this CVE based on publicly
available information at the time of analysis. The CNA has not provided a score
within the CVE List.


CVSS 2.0 Severity and Metrics:


NIST: NVD
Base Score:  6.5 MEDIUM
Vector:  (AV:N/AC:L/Au:S/C:P/I:P/A:P)


NVD Analysts use publicly available information to associate vector strings and
CVSS scores. We also display any CVSS information provided within the CVE List
from the CNA.

Note: NVD Analysts have published a CVSS score for this CVE based on publicly
available information at the time of analysis. The CNA has not provided a score
within the CVE List.




REFERENCES TO ADVISORIES, SOLUTIONS, AND TOOLS

By selecting these links, you will be leaving NIST webspace. We have provided
these links to other web sites because they may have information that would be
of interest to you. No inferences should be drawn on account of other sites
being referenced, or not, from this page. There may be other web sites that are
more appropriate for your purpose. NIST does not necessarily endorse the views
expressed, or concur with the facts presented on these sites. Further, NIST does
not endorse any commercial products that may be mentioned on these sites. Please
address comments about this page to nvd@nist.gov.

Hyperlink Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42321
Patch  Vendor Advisory 


WEAKNESS ENUMERATION

CWE-ID CWE Name Source NVD-CWE-noinfo Insufficient Information NIST  


KNOWN AFFECTED SOFTWARE CONFIGURATIONS SWITCH TO CPE 2.2


CPES LOADING, PLEASE WAIT.

Configuration 1 ( hide )


 cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*
   Show Matching CPE(s)
 cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*
   Show Matching CPE(s)
 cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*
   Show Matching CPE(s)
 cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*
   Show Matching CPE(s)


Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.



CHANGE HISTORY

1 change records found show changes

INITIAL ANALYSIS 11/10/2021 1:25:35 PM

Action Type Old Value New Value Added CPE Configuration

OR
     *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*
     *cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*
     *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*
     *cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*



Added CVSS V2

NIST (AV:N/AC:L/Au:S/C:P/I:P/A:P)



Added CVSS V3.1

NIST AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H



Added CWE

NIST NVD-CWE-noinfo



Changed Reference Type

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42321 No Types Assigned



https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42321 Patch, Vendor Advisory



QUICK INFO

CVE Dictionary Entry:
CVE-2021-42321
NVD Published Date:
11/09/2021
NVD Last Modified:
11/10/2021
Source:
Microsoft Corporation


 * twitter (link is external)
 * facebook (link is external)
 * linkedin (link is external)
 * youtube (link is external)
 * rss
 * govdelivery (link is external)


HEADQUARTERS
100 Bureau Drive
Gaithersburg, MD 20899
(301) 975-2000

Webmaster | Contact Us | Our Other Offices
Incident Response Assistance and Non-NVD Related
Technical Cyber Security Questions:
US-CERT Security Operations Center
Email: soc@us-cert.gov
Phone: 1-888-282-0870
Sponsored by
                      CISA

Privacy Statement | Privacy Policy | Security Notice | Accessibility Statement |
NIST Privacy Program | No Fear Act Policy | Disclaimer | FOIA | Environmental
Policy Statement | Cookie Disclaimer | Scientific Integrity Summary | NIST
Information Quality Standards | Commerce.gov | Healthcare.gov | Science.gov |
USA.gov |