1. Home
  2. Mapping Frameworks
  3. Known Exploited Vulnerabilities Home
  4. Security Feature Bypass Capability Group

Known Exploited Vulnerabilities Security Feature Bypass Capability Group

All Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
CVE-2021-31207 Microsoft Exchange Server Security Feature Bypass Vulnerability primary_impact T1565 Data Manipulation
Comments
This vulnerability is exploited via authentication bypass, allowing the adversary to write to files.
References
  1. https://www.rescana.com/post/critical-analysis-of-cve-2021-31207-bypassing-security-in-microsoft-exchange-server
  2. https://packetstormsecurity.com/files/163895/Microsoft-Exchange-ProxyShell-Remote-Code-Execution.html
CVE-2021-31207 Microsoft Exchange Server Security Feature Bypass Vulnerability exploitation_technique T1548.002 Bypass User Account Control
Comments
This vulnerability is exploited via authentication bypass, allowing the adversary to write to files.
References
  1. https://www.rescana.com/post/critical-analysis-of-cve-2021-31207-bypassing-security-in-microsoft-exchange-server
  2. https://packetstormsecurity.com/files/163895/Microsoft-Exchange-ProxyShell-Remote-Code-Execution.html
CVE-2015-0310 Adobe Flash Player ASLR Bypass Vulnerability exploitation_technique T1189 Drive-by Compromise
Comments
This vulnerability is exploited with maliciously-crafted code hosted on a website via drive-by compromise. It has been seen used in the wild by exploit kits.
References
  1. https://www.zero-day.cz/database/172/
CVE-2023-21715 Microsoft Office Publisher Security Feature Bypass Vulnerability exploitation_technique T1204.002 Malicious File
Comments
CVE-2023-21715 is a security feature bypass vulnerability exploitable when a user opens a specially-crafted file bypassing macro policies.
References
  1. https://www.helpnetsecurity.com/2023/02/14/microsoft-patches-three-exploited-zero-days-cve-2023-21715-cve-2023-23376-cve-2023-21823/

Capabilities

Capability ID Capability Name Number of Mappings
CVE-2021-31207 Microsoft Exchange Server Security Feature Bypass Vulnerability 2
CVE-2015-0310 Adobe Flash Player ASLR Bypass Vulnerability 1
CVE-2023-21715 Microsoft Office Publisher Security Feature Bypass Vulnerability 1