{"id":"CVE-2020-0688","state":"PUBLISHED","title":"A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption ","description":"A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.","publishedAt":"2020-02-11T21:22:59.000Z","updatedAt":"2025-10-21T23:35:51.234Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"microsoft","products":["Microsoft Microsoft Exchange Server 2013","Microsoft Microsoft Exchange Server 2019 Cumulative Update 3","Microsoft Microsoft Exchange Server 2016 Cumulative Update 14","Microsoft Microsoft Exchange Server 2016 Cumulative Update 15","Microsoft Microsoft Exchange Server 2019 Cumulative Update 4","Microsoft Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30"],"affected":[{"vendor":"Microsoft","product":"Microsoft Exchange Server 2013","versions":[{"version":"Cumulative Update 23","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft Exchange Server 2019 Cumulative Update 3","versions":[{"version":"unspecified","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft Exchange Server 2016 Cumulative Update 14","versions":[{"version":"unspecified","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft Exchange Server 2016 Cumulative Update 15","versions":[{"version":"unspecified","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft Exchange Server 2019 Cumulative Update 4","versions":[{"version":"unspecified","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30","versions":[{"version":"unspecified","status":"affected"}]}],"references":["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688","https://www.zerodayinitiative.com/advisories/ZDI-20-258/","http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html","http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0688"],"weaknesses":["CWE-287"],"ingestedAt":"2026-10-29T19:46:18.551Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/0xxx/CVE-2020-0688.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2020-0688","state":"PUBLISHED","datePublished":"2020-02-11T21:22:59.000Z","dateUpdated":"2025-10-21T23:35:51.234Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2019-11-04T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'."}],"affected":[{"vendor":"Microsoft","product":"Microsoft Exchange Server 2013","versions":[{"version":"Cumulative Update 23","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft Exchange Server 2019 Cumulative Update 3","versions":[{"version":"unspecified","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft Exchange Server 2016 Cumulative Update 14","versions":[{"version":"unspecified","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft Exchange Server 2016 Cumulative Update 15","versions":[{"version":"unspecified","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft Exchange Server 2019 Cumulative Update 4","versions":[{"version":"unspecified","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30","versions":[{"version":"unspecified","status":"affected"}]}],"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688","tags":["x_refsource_MISC"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-20-258/","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html","tags":["x_refsource_MISC"]}],"problemTypes":[{"descriptions":[{"description":"Remote Code Execution","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"microsoft","dateUpdated":"2020-03-04T15:06:05.000Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secure@microsoft.com","ID":"CVE-2020-0688","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Microsoft Exchange Server 2013","version":{"version_data":[{"version_value":"Cumulative Update 23"}]}},{"product_name":"Microsoft Exchange Server 2019 Cumulative Update 3","version":{"version_data":[{"version_value":""}]}},{"product_name":"Microsoft Exchange Server 2016 Cumulative Update 14","version":{"version_data":[{"version_value":""}]}},{"product_name":"Microsoft Exchange Server 2016 Cumulative Update 15","version":{"version_data":[{"version_value":""}]}},{"product_name":"Microsoft Exchange Server 2019 Cumulative Update 4","version":{"version_data":[{"version_value":""}]}},{"product_name":"Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30","version":{"version_data":[{"version_value":""}]}}]},"vendor_name":"Microsoft"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Remote Code Execution"}]}]},"references":{"reference_data":[{"name":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688","refsource":"MISC","url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688"},{"name":"https://www.zerodayinitiative.com/advisories/ZDI-20-258/","refsource":"MISC","url":"https://www.zerodayinitiative.com/advisories/ZDI-20-258/"},{"name":"http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html"},{"name":"http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-20-258/","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T06:11:05.469Z"}},{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0688","tags":["government-resource"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2020-0688","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-02-04T18:44:23.710392Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2021-11-03","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0688"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","lang":"en","type":"CWE","description":"CWE-287 Improper Authentication"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-21T23:35:51.234Z"},"timeline":[{"time":"2021-11-03T00:00:00.000Z","lang":"en","value":"CVE-2020-0688 added to CISA KEV"}]}]}}}