CVE-2021-34473
Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS
9.1
Crítica
EPSS
100.0%
p100
KEV
SIM
3 de nov. de 2021
Exploit Today
80
0-100
Publicado: 14 de jul. de 2021 · Última mod.: 10 de ago. de 2026 · CWE-918
100.0%EPSS · 30 dias100.0%
2026-10-082026-11-05
Produto
Microsoft / Exchange Server
Vulnerabilidade
Microsoft Exchange Server Remote Code Execution Vulnerability
Adicionado ao KEV
3 de nov. de 2021
Corrigir até
17 de nov. de 2021
Uso conhecido em ransomware
Sim
Descrição resumida
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.
Ação necessária
Apply updates per vendor instructions.
Notas
https://nvd.nist.gov/vuln/detail/CVE-2021-34473
Microsoft Exchange Server Remote Code Execution Vulnerability
- msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473
- packetstormsecurity.comhttp://packetstormsecurity.com/files/163895/Microsoft-Exchange-ProxyShell-Remote-Code-Execution.html
- portal.msrc.microsoft.comhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34473
- www.zerodayinitiative.comhttps://www.zerodayinitiative.com/advisories/ZDI-21-821/
- www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-34473
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-691377.7 ALT—
——0SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CalendarAccount testConnection action passes an authenticated caller's server_url directly to curl without host, address, or scheme validation. The affected flow begins at CalendarAccount::action_testConnection and uses server_url, CalDAVProvider::makeCalDAVRequest(), and PROPFIND to carry attacker-controlled data or authorization state into the security-sensitive operation. The server sends a PROPFIND request from its network context and returns non-success response bodies, enabling internal-service access, partial response disclosure, service enumeration, and possible cloud metadata access. This issue is fixed in versions 7.15.2 and 8.10.2.7hCVE-2026-63111——
——0SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 module API lacks module-level authorization and permits a low-privileged user to create SchedulersJobs records with attacker-controlled target values. The affected flow begins at /Api/V8/module and uses SchedulersJobs, target, cron.php, and url:: to carry attacker-controlled data or authorization state into the security-sensitive operation. Cron.php later executes the queued job with system privileges, and the url:: target makes server-side requests to internal or external hosts, can follow redirects, can persist as a recurring job, and may expose internal services. This issue is fixed in versions 7.15.2 and 8.10.2.7hCVE-2026-616497.7 ALT—
——0SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the SSRF protection added in 7.15.1 uses a substring comparison in isSelfRequest() rather than hostname equality. The affected flow begins at validate_external_host() and uses isSelfRequest(), and stripos() to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated attacker can place the server hostname in a URL path to bypass IP validation and direct server-side requests to internal services. This issue is fixed in versions 7.15.2 and 8.10.2.7hCVE-2026-1232044.3 MÉD—
——0Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports.7hCVE-2026-1232015.3 MÉD—
——0Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is_bad_url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords.7hCVE-2026-1231256.5 MÉD—
——0The Symfony Validator component IpValidator incompletely classifies internal addresses in the filtered modes of the Ip constraint, so some internal addresses are accepted as public, which can lead to Server-Side Request Forgery (SSRF) in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.
In these modes, IpValidator relies on the PHP flags FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE to classify addresses as public, private, or reserved. These flags do not cover shared address space (100.64.0.0/10) or IPv4-mapped, IPv4-compatible, and 6to4 IPv6 addresses, which can embed internal IPv4 addresses. A value such as ::ffff:127.0.0.1 can therefore pass validation even though it points to an internal host.
Applications that rely on the Ip constraint to reject internal addresses, for example before making a server-side request to a user-supplied address, can be exposed to SSRF.9h