Security News > 2022 > April > Microsoft asks bug hunters to probe on-premises Exchange, SharePoint servers

Bug hunters that discover and report high-impact security vulnerabilities in on-premises Exchange, SharePoint and Skype for Business may earn as much as $26,000 per eligible submission, Microsoft has announced.

The highest awards will go to those who discover vulnerabilities that have the highest potential impact to customer security.

Authentication bypass allows for unauthenticated exploitation which results in mass exploitation of vulnerabilities.

Server-Side Request Forgery allows an attacker to make server-side HTTP requests to arbitrary URLs.

Authenticated Server-Side Request Forgery allows an attacker to make authenticated server-side HTTP requests to arbitrary URL. More information about in scope and out of scope vulnerabilities is available on the Microsoft Applications and On-Premises Servers Bounty Program page.

In general, technical vulnerabilities are in-scope, and phishing or other social engineering attacks against Microsoft employees are forbidden.

News URL

https://www.helpnetsecurity.com/2022/04/06/bug-on-premises-exchange/