Skype for Business Remote Code Execution Vulnerability
CVE-2023-36789

7.2HIGH

Key Information:

Vendor

Microsoft
Status
Skype For Business Server 2019 Cu7
Skype For Business Server 2015 Cu13
Vendor
CVE Published:
10 October 2023

What is CVE-2023-36789?

Skype for Business is subject to a remote code execution vulnerability that allows an attacker to execute arbitrary code on the user's system. By exploiting this vulnerability, an attacker could take complete control of affected systems, leading to significant risks, including unauthorized access to sensitive information and disruption of services. Users are encouraged to apply the available security updates to protect against potential exploitation.

Affected Version(s)

Skype for Business Server 2015 CU13 Unknown 9319.0 < 6.0.9319.869

Skype for Business Server 2019 CU7 Unknown 2046.0 < 7.0.246.530

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.