Microsoft Corporation Skype for Business
At a glance
- Source
- NVD
- EPSS
- EPSS 9.39 % · percentile 95 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- microsoft
- NVD status
- Modified
Description
Skype for Business in Microsoft Lync 2013 SP1 and Skype for Business 2016 allows an attacker to steal an authentication hash that can be reused elsewhere, due to how Skype for Business handles authentication requests, aka "Skype for Business Elevation of Privilege Vulnerability."
Weaknesses (CWE)
- CWE-294 — Authentication Bypass by Capture-replay
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2017-3394
- GCVE · GCVE-0-2017-11786
CERT-FR advisories
- CERTFR-2017-AVI-346 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:*:*cpe:2.3:a:microsoft:skype_for_business:2016:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Microsoft Corporation · Skype for Business | affected Microsoft Lync 2013 SP1 and Skype for Business 2016 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |