Skype for Business Remote Code Execution Vulnerability
CVE-2023-36786

7.2HIGH

Key Information:

Vendor

Microsoft
Status
Skype For Business Server 2015 Cu13
Skype For Business Server 2019 Cu7
Vendor
CVE Published:
10 October 2023

What is CVE-2023-36786?

A remote code execution vulnerability exists in Skype for Business due to improper validation of input. An attacker who successfully exploits this vulnerability could run arbitrary code on the affected system. This poses a significant risk, as it can lead to unauthorized access to sensitive information, system takeovers, or the spread of malware. Users are encouraged to apply the necessary updates to mitigate this risk and enhance their system's security.

Affected Version(s)

Skype for Business Server 2015 CU13 Unknown 9319.0 < 6.0.9319.869

Skype for Business Server 2019 CU7 Unknown 2046.0 < 7.0.246.530

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.