The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - Multiple Vulnerabilites with the included libraries from     Oracle Outside. (CVE-2018-18223, CVE-2018-18224,     CVE-2018-3147, CVE-2018-3217, CVE-2018-3218, CVE-2018-3219,     CVE-2018-3220, CVE-2018-3221, CVE-2018-3222, CVE-2018-3223,     CVE-2018-3224, CVE-2018-3225, CVE-2018-3226, CVE-2018-3227,     CVE-2018-3228, CVE-2018-3229, CVE-2018-3230, CVE-2018-3231,     CVE-2018-3232, CVE-2018-3233, CVE-2018-3234, CVE-2018-3302)

  - An elevation of privilege vulnerability exists in     Exchange Web Services and Push Notifications. An     unauthenticated, remote attacker can exploit, via a     man-in-the-middle attack forwarding an authentication     request to the Domain Controller, to gain any users     privileges. (CVE-2019-0686)

  - An elevation of privilege vulnerability exists in     Exchange Web Services and Push Notifications. An     unauthenticated, remote attacker can exploit, via a     man-in-the-middle attack forwarding an authentication     request to the Domain Controller, to gain Domain     Administrator privileges. (CVE-2019-0724)

Detections

Analytics

Security Updates for Exchange (February 2019)

high Nessus Plugin ID 122129