Microsoft updates guidance for ‘ProxyNotShell’ bugs after researchers get around mitigations
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2022-41040+1 related CVE | Server-Side Request Forgery in Microsoft Exchange Server (ProxyNotShell) | 8.8 group max | 100% | KEVRansomwarePoC | KEV |
From the original article
4 min read at therecord.media
Microsoft has updated the guidance it provided for two zero-day vulnerabilities discovered last week affecting Exchange Server software. The original guidance provided for the bugs, which are known colloquially as “ProxyNotShell”, was found to be insufficient in addressing the issues, according to several security researchers who spent the weekend examining it.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.