PT-2021-2076 · Microsoft · Exchange Server

Mohamed Sayed · Published 2021-02-09 · Updated 2026-03-10 · CVE-2021-1730

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server (affected versions not specified)

Description: A spoofing issue exists in Microsoft Exchange Server, related to errors in information representation by the user interface. This could allow a remote attacker to conduct spoofing attacks, potentially impersonating a user. The estimated number of potentially affected devices worldwide is not provided. There is no information about real-world incidents where this issue was exploited.

Recommendations: To prevent these types of attacks, download inline images from different DNS domains than the rest of OWA. Please see further instructions in the FAQ to put in place these mitigations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-451

Related Identifiers

BDU:2021-00927

CVE-2021-1730

Affected Products

Exchange Server

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2021-1730 · Security Note
• https://bdu.fstec.ru/vul/2021-00927 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1730 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1730 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1730 · Vendor Advisory
• https://t.me/cibsecurity/24174 · Telegram Post
• https://twitter.com/jack_techi/status/1826060166909051340 · Twitter Post
• https://t.me/cvenotify/10524 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021020931 · Note
• https://t.me/cvenotify/10531 · Telegram Post
• https://twitter.com/cozumpark/status/1767646282724864430 · Twitter Post
• https://t.me/cibsecurity/24172 · Telegram Post