GPU Al/ML today! NVIDIA A100s & H100s for €1.43/h
en
Get started for free Sign in

Select the Gcore Platform

Recommended
Gcore Edge Solutions
Go to Gcore Platform →
Products:
  • Edge Delivery (CDN)
  • DNS with failover
  • Virtual Machines
  • Bare Metal
  • Cloud Load Balancers
  • Managed Kubernetes
  • AI Infrastructure
  • Edge Security (DDOS+WAF)
  • FaaS
  • Streaming
  • Object Storage
  • ImageStack (Optimize and Resize)
  • Edge Compute (Coming soon)
Gcore Hosting
Go to Gcore Hosting →
Products:
  • VPS Hosting
  • Dedicated Servers
  • SSL Certificates

Share

  1. Blog
  2. Security

Mitigation of two new zero-day vulnerabilities in Microsoft Exchange

Published November 3, 2022

On September 29, Microsoft officially disclosed that it is investigating two zero-day vulnerabilities affecting Exchange Server 2013, 2016, and 2019. We prepared this post for users of these products to briefly explain the issue and how you can minimize risk.

What are these vulnerabilities? CVE-2022-41040 is a Server-Side Request Forgery (SSRF) vulnerability, while CVE-2022-41082 allows remote code execution if the attacker has access to PowerShell.

Are they being used in the wild? Yes, Microsoft has officially confirmed that they are. The company is aware of “limited targeted attacks” that use these vulnerabilities to penetrate users’ systems. In these attacks, CVE-2022-41040 can allow an authenticated attacker to trigger CVE-2022-41082 remotely.

However, the risks are quite low. The company emphasized that authenticated access to the vulnerable Exchange Server is required to exploit either of the two vulnerabilities successfully.

How can risks be mitigated? Unfortunately, there are no patches yet. However, if you’re a Microsoft Exchange Online user, you’re out of danger. The service has built-in detections and mitigations to protect customers.

If you’re a Microsoft Exchange Server user, we advise completing both the “URL Rewrite rule” mitigation for CVE-2022-41040 and the “Disable remote PowerShell for non-admins” mitigation for CVE-2022-41082. This will help reduce risks. You can find detailed instructions in the Microsoft Security Response Center.

To be protected from zero-day vulnerabilities, use Gcore NG-WAF. We’ll keep you informed of and safe from any threats.

Related articles

How we protect clients’ servers anywhere in the world. Everything about GRE tunneling
How we protect clients’ servers anywhere in the world. Everything about GRE tunneling

How we protect clients’ servers anywhere in the world. Everything about GRE tunnelingWe will explain what GRE tunnels are, how…

Gcore Zero-Day Radar: Exploits during Q3–Q4 of 2022
Gcore Zero-Day Radar: Exploits during Q3–Q4 of 2022

List of top zero-day vulnerabilities exploited during Q3–Q4 of 2022.

GeoIP filtering at 400 Gbps with XDP on an eBPF space
GeoIP filtering at 400 Gbps with XDP on an eBPF space

Our experience with location-based packet filtering on an eBPF.

Related articles

How we protect clients’ servers anywhere in the world. Everything about GRE tunneling
Security
How we protect clients’ servers anywhere in the world. Everything about GRE tunneling
How we protect clients’ servers anywhere in the world. Everything about GRE tunnelingWe will explain what GRE tunnels are, how...
March 24, 2023 6 min read
Gcore Zero-Day Radar: Exploits during Q3–Q4 of 2022
Protection, Security
Gcore Zero-Day Radar: Exploits during Q3–Q4 of 2022
List of top zero-day vulnerabilities exploited during Q3–Q4 of 2022.
December 23, 2022 3 min read
GeoIP filtering at 400 Gbps with XDP on an eBPF space
Security
GeoIP filtering at 400 Gbps with XDP on an eBPF space
Our experience with location-based packet filtering on an eBPF.
December 5, 2022 3 min read

Subscribe to a useful newsletter

Favorable offers and important news once a month. No spam.