Microsoft Exchange Server Cross-Site Scripting Vulnerability Allowing Spoofing

A cross-site scripting vulnerability has been identified in Microsoft Exchange Server. This issue arises from improper input neutralization during web page generation, allowing an unauthorized attacker to perform spoofing over the network. The vulnerability affects multiple versions of Microsoft Exchange Server, including the Subscription Edition RTM, Exchange Server 2019 Cumulative Update 15, Exchange Server 2019 Cumulative Update 14, and Exchange Server 2016 Cumulative Update 23.

Impact

Exploitation of this vulnerability allows for spoofing attacks, where an attacker can impersonate another user or entity.

Remediation

Users can enable the Exchange Emergency Mitigation Service, which provides automatic mitigation for this vulnerability. More information and instructions are available on the Microsoft Exchange blog.