Remote Code Execution Vulnerability in Skype for Business
CVE-2017-8550

5.4MEDIUM

Key Information:

Vendor
Microsoft
Status
Skype For Business
Vendor
CVE Published:
15 June 2017

Summary

A remote code execution vulnerability exists in Skype for Business due to improper sanitation of specially crafted content. An attacker could exploit this vulnerability by convincing a user to open a malicious document. Successful exploitation lets the attacker execute arbitrary code on the affected system, potentially gaining access to sensitive data and impacting system integrity. It is crucial for organizations to apply the latest security updates to mitigate this risk.

Affected Version(s)

Skype for Business Microsoft Office 2016 Click-to-Run (C2R)

References

https://portal.msrc.microsoft.com/en-US/security-guidance...
x_refsource_CONFIRM
https://www.exploit-db.com/exploits/42316/
exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/98916
vdb-entryx_refsource_BID

EPSS Score

13% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.