CVE-2021-1730

Microsoft Exchange Server Spoofing Vulnerability

CVE-2021-1730 is fixed in 2 products on 1 platform, first by KB4571788, released February 9, 2021. It is not reported as exploited. Patch Radar priority: Routine.

Routine
CVSS
5.4
Important
Exploitation
None reported
Exploitation Less Likely
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0182
78th percentile

<p>A spoofing vulnerability exists in Microsoft Exchange Server which could result in an attack that would allow a malicious actor to impersonate the user.</p> <p>This update addresses this vulnerability.</p> <p>To prevent these types of attacks, Microsoft recommends customers to download inline images from different DNSdomains than the rest of OWA. Please see further instructions in the FAQ to put in place this mitigations.</p>

Where it's fixed

ProductFixed inFixReleased
Microsoft
Microsoft Exchange Server 2016 Cumulative Update 18 KB4571788 Feb 9, 2021
Microsoft Exchange Server 2019 Cumulative Update 7 KB4571787 Feb 9, 2021

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.