Coverage for October 2022 zero-day vulnerabilities in Microsoft Exchange Server - CVE-2022-41040 (SSRF) and CVE-2022-41082 (RCE)

Technical Articles ID: KB96051
Last Modified: 2024-01-22 09:37:46 Etc/GMT

Environment

Trellix Intrusion Prevention System (Trellix IPS)

Microsoft Exchange Server 2019, 2016, 2013

Summary

Recent updates to this article

Date	Update
January 22, 2024	Removed the End of Life category tags.

We're aware of CVE-2022-41040 and CVE-2022-41082, which Microsoft recently released. CVE-2022-41040 is a server-side request forgery (SSRF) vulnerability. CVE-2022-41082 allows remote code execution (RCE) when Exchange PowerShell is accessible to the attacker. It's recommended that customers review the mitigation steps for Exchange as described in the Microsoft Security Response Center post for these vulnerabilities. These vulnerabilities are considered High, with a CVSS (3.1) score of 8.8 (CVSS calculator).

Owing to the severity of the vulnerabilities, we've created this article to provide communication on actions customers can take to mitigate risk in their environment. Subscribe to this article to receive updates pertaining to related coverage and countermeasures.

To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

For further vendor information, see the following:

Problem

Microsoft reported CVE-2022-41040 and CVE-2022-41082. In these attacks, CVE-2022-41040 can enable an authenticated attacker to remotely trigger CVE-2022-41082. Authenticated access to the vulnerable Exchange Server is needed to successfully exploit either vulnerability.

Solution

How can our product solutions help?
It's always advised, and a best practice, to make sure that you keep software and operating systems up to date on available updates and security updates as they're released. We also recommend evaluating and implementing general countermeasures against entry-level threats where suited in your environment. For more information, see KB91836 - Countermeasures for entry vector threats.

We're evaluating product coverage across our portfolio of security solutions against these vulnerabilities. This article will be updated accordingly as possible coverage opportunities and countermeasures are identified.

Product capabilities are currently available for the following component:

Trellix IPS Signature Set: These vulnerabilities are covered by the following signature set.

Signature set version	10.9.37.6
Attack ID	0x45298b00
Attack name	HTTP: Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-34473)
Release date	October 4, 2022

For more information about this release, see KB96050 - REGISTERED - Trellix IPS Signature Sets Release Bulletin (10.9.37.6).

NOTE: The referenced content is available only to logged in ServicePortal users. To view the content, click the link and log in when prompted.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Coverage for October 2022 zero-day vulnerabilities in Microsoft Exchange Server - CVE-2022-41040 (SSRF) and CVE-2022-41082 (RCE)

Environment

Summary

Problem

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Coverage for October 2022 zero-day vulnerabilities in Microsoft Exchange Server - CVE-2022-41040 (SSRF) and CVE-2022-41082 (RCE)

Environment

Summary

Problem

Solution

Affected Products

Languages:

Choose your region

Title

Title