Microsoft Office Elevation of Privilege Vulnerability
CVE-2020-1025

9.8CRITICAL

Key Information:

Vendor

Microsoft
Status
Skype For Business Server 2019 Cu2
Skype For Business Server 2015 Cu 8
Microsoft Lync Server 2013
Microsoft Sharepoint Enterprise Server 2016
Vendor
CVE Published:
14 July 2020

What is CVE-2020-1025?

An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation. An attacker who successfully exploited the vulnerability could bypass authentication and achieve improper access. To exploit this vulnerability, an attacker would need to modify the token. The update addresses the vulnerability by modifying how Microsoft SharePoint Server and Skype for Business Server validate tokens.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Microsoft Lync Server 2013 Unknown 0

Microsoft SharePoint Enterprise Server 2016 x64-based Systems 16.0.0

Microsoft SharePoint Foundation 2013 Service Pack 1 x64-based Systems 15.0.0

References

https://portal.msrc.microsoft.com/en-US/security-guidance...
x_refsource_MISC

EPSS Score

13% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.