« Volver al listado

CVE-2019-1373

Estado: ModificadaCrítica (9.8)—

A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShell, aka 'Microsoft Exchange Remote Code Execution Vulnerability'.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microsoft — Exchange Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-1373",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Microsoft Exchange Server 2019",
          "versions": [
            {
              "status": "affected",
              "version": "Cumulative Update 2"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Exchange Server 2016",
          "versions": [
            {
              "status": "affected",
              "version": "Cumulative Update 13"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Exchange Server 2013",
          "versions": [
            {
              "status": "affected",
              "version": "Cumulative Update 23"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Exchange Server 2019 Cumulative Update 3",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Exchange Server 2016 Cumulative Update 14",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-11-12T19:15:12.003",
  "references": [
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1373",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1373",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShell, aka 'Microsoft Exchange Remote Code Execution Vulnerability'."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de ejecución de código remota en Microsoft Exchange por medio de la deserialización de metadatos mediante PowerShell, también se conoce como \"Microsoft Exchange Remote Code Execution Vulnerability\"."
    }
  ],
  "lastModified": "2026-06-17T02:28:29.097",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA166F2A-D83B-4D50-AD0B-668D813E0585"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4DF5BDB5-205D-4B64-A49A-0152AFCF4A13"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55284CF7-0D04-4216-83FE-4B1F9CA94207"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE320413-D2C9-4B28-89BF-361B44A3F0FF"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "104F96DC-E280-4E0A-8586-B043B55888C2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}