CVE-2021-33766

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server (affected versions not specified)

Description The issue is an information disclosure affecting Microsoft Exchange Server. It involves an authentication bypass, specifically through a flaw related to delegated authentication and the handling of the SecurityToken cookie. An unauthenticated attacker can leverage this to gain access to mailbox configuration parameters, potentially altering email forwarding rules and modifying the Exchange Control Panel (ECP) configuration. This allows for the mirroring of email traffic and access to sensitive information. The vulnerability, known as ProxyToken, is based on a combination of the SecurityToken cookie and an HTTP 500 error containing a valid string. The issue could reveal personal information and sensitive company data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.