Vulnerability-Lookup

CVE-2023-36780 (GCVE-0-2023-36780)

Vulnerability from cvelistv5 – Published: 2023-10-10 17:08 – Updated: 2025-04-14 22:46

Title

Skype for Business Remote Code Execution Vulnerability

Summary

Skype for Business Remote Code Execution Vulnerability

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CWE

CWE-426 - Untrusted Search Path

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Microsoft	Skype for Business Server 2019 CU7	Affected: 2046.0 , < 7.0.246.530 (custom)
Microsoft	Skype for Business Server 2015 CU13	Affected: 9319.0 , < 6.0.9319.869 (custom)

Date Public

2023-10-10 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-36780",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-10T13:26:32.285813Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-10T13:26:42.809Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:01:09.430Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Skype for Business Remote Code Execution Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Skype for Business Server 2019 CU7",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "7.0.246.530",
              "status": "affected",
              "version": "2046.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Skype for Business Server 2015 CU13",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.0.9319.869",
              "status": "affected",
              "version": "9319.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:skype_for_business_server:*:cu7:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.246.530",
                  "versionStartIncluding": "2046.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:skype_for_business_server:*:cu13:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.9319.869",
                  "versionStartIncluding": "9319.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-10-10T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Skype for Business Remote Code Execution Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-426",
              "description": "CWE-426: Untrusted Search Path",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-14T22:46:43.180Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Skype for Business Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780"
        }
      ],
      "title": "Skype for Business Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-36780",
    "datePublished": "2023-10-10T17:08:11.540Z",
    "dateReserved": "2023-06-27T15:11:59.870Z",
    "dateUpdated": "2025-04-14T22:46:43.180Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-36780",
      "date": "2026-05-29",
      "epss": "0.00702",
      "percentile": "0.72365"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13:*:*:*:*:*:*\", \"matchCriteriaId\": \"590D1547-C998-4BDD-BE06-379099E2D9C7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_7:*:*:*:*:*:*\", \"matchCriteriaId\": \"4172BD0D-5F18-4E0C-8BAF-72A052432B2B\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Skype for Business Remote Code Execution Vulnerability\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad de ejecuci\\u00f3n remota de c\\u00f3digo de Skype Empresarial\"}]",
      "id": "CVE-2023-36780",
      "lastModified": "2024-11-21T08:10:35.203",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"secure@microsoft.com\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 5.9}]}",
      "published": "2023-10-10T18:15:17.587",
      "references": "[{\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780\", \"source\": \"secure@microsoft.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "secure@microsoft.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"secure@microsoft.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-426\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-36780\",\"sourceIdentifier\":\"secure@microsoft.com\",\"published\":\"2023-10-10T18:15:17.587\",\"lastModified\":\"2024-11-21T08:10:35.203\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Skype for Business Remote Code Execution Vulnerability\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo de Skype Empresarial\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-426\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13:*:*:*:*:*:*\",\"matchCriteriaId\":\"590D1547-C998-4BDD-BE06-379099E2D9C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_7:*:*:*:*:*:*\",\"matchCriteriaId\":\"4172BD0D-5F18-4E0C-8BAF-72A052432B2B\"}]}]}],\"references\":[{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780\", \"name\": \"Skype for Business Remote Code Execution Vulnerability\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T17:01:09.430Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-36780\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-10T13:26:32.285813Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-10T13:26:39.264Z\"}}], \"cna\": {\"title\": \"Skype for Business Remote Code Execution Vulnerability\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C\"}, \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Microsoft\", \"product\": \"Skype for Business Server 2019 CU7\", \"versions\": [{\"status\": \"affected\", \"version\": \"2046.0\", \"lessThan\": \"7.0.246.530\", \"versionType\": \"custom\"}], \"platforms\": [\"Unknown\"]}, {\"vendor\": \"Microsoft\", \"product\": \"Skype for Business Server 2015 CU13\", \"versions\": [{\"status\": \"affected\", \"version\": \"9319.0\", \"lessThan\": \"6.0.9319.869\", \"versionType\": \"custom\"}], \"platforms\": [\"Unknown\"]}], \"datePublic\": \"2023-10-10T07:00:00.000Z\", \"references\": [{\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780\", \"name\": \"Skype for Business Remote Code Execution Vulnerability\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en-US\", \"value\": \"Skype for Business Remote Code Execution Vulnerability\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en-US\", \"type\": \"CWE\", \"cweId\": \"CWE-426\", \"description\": \"CWE-426: Untrusted Search Path\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:microsoft:skype_for_business_server:*:cu7:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.0.246.530\", \"versionStartIncluding\": \"2046.0\"}, {\"criteria\": \"cpe:2.3:a:microsoft:skype_for_business_server:*:cu13:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.0.9319.869\", \"versionStartIncluding\": \"9319.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"shortName\": \"microsoft\", \"dateUpdated\": \"2025-04-14T22:46:43.180Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-36780\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-14T22:46:43.180Z\", \"dateReserved\": \"2023-06-27T15:11:59.870Z\", \"assignerOrgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"datePublished\": \"2023-10-10T17:08:11.540Z\", \"assignerShortName\": \"microsoft\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CERTFR-2023-AVI-0830

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer une élévation de privilèges, une usurpation d'identité, une exécution de code à distance, un déni de service et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Microsoft	N/A	Microsoft Exchange Server 2019 Cumulative Update 13
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.2
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.7
Microsoft	N/A	Microsoft OLE DB Driver 19 pour SQL Server
Microsoft	N/A	Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (CU 4)
Microsoft	N/A	Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 (GDR)
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.6
Microsoft	N/A	Microsoft Common Data Model SDK pour C#
Microsoft	N/A	Microsoft SQL Server 2022 pour systèmes x64 (GDR)
Microsoft	N/A	Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft	Azure	Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 Azure Connect Feature Pack
Microsoft	N/A	Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (CU 4)
Microsoft	N/A	Skype pour Business Server 2019 CU7
Microsoft	N/A	Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (GDR)
Microsoft	N/A	Microsoft Dynamics 365 (on-premises) version 9.1
Microsoft	N/A	Skype pour Business Server 2015 CU13
Microsoft	N/A	Microsoft 365 Apps pour Enterprise pour systèmes 32 bits
Microsoft	N/A	Microsoft 365 Apps pour Enterprise pour 64 bits Systems
Microsoft	N/A	Microsoft SQL Server 2017 pour systèmes x64 (GDR)
Microsoft	N/A	Microsoft SQL Server 2017 pour systèmes x64 (CU 31)
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.4
Microsoft	N/A	Microsoft SQL Server 2019 pour systèmes x64 (GDR)
Microsoft	N/A	Microsoft ODBC Driver 18 pour SQL Server on MacOS
Microsoft	N/A	Microsoft SQL Server 2019 pour systèmes x64 (CU 22)
Microsoft	N/A	Microsoft ODBC Driver 17 pour SQL Server on MacOS
Microsoft	N/A	Microsoft Dynamics 365 (on-premises) version 9.0
Microsoft	N/A	Microsoft Common Data Model SDK pour TypeScript
Microsoft	N/A	Microsoft SQL Server 2022 pour systèmes x64 (CU 8)
Microsoft	N/A	Microsoft Common Data Model SDK pour Java
Microsoft	N/A	Microsoft ODBC Driver 17 pour SQL Server on Linux
Microsoft	N/A	Microsoft Exchange Server 2019 Cumulative Update 12
Microsoft	N/A	Microsoft OLE DB Driver 18 pour SQL Server
Microsoft	N/A	Microsoft ODBC Driver 18 pour SQL Server on Linux
Microsoft	N/A	Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (GDR)
Microsoft	N/A	Microsoft Common Data Model SDK pour Python

References

Title

Publication Time

CERTFR-2023-AVI-0830

Vulnerability from certfr_avis - Published: - Updated:

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Microsoft	N/A	Microsoft Exchange Server 2019 Cumulative Update 13
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.2
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.7
Microsoft	N/A	Microsoft OLE DB Driver 19 pour SQL Server
Microsoft	N/A	Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (CU 4)
Microsoft	N/A	Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 (GDR)
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.6
Microsoft	N/A	Microsoft Common Data Model SDK pour C#
Microsoft	N/A	Microsoft SQL Server 2022 pour systèmes x64 (GDR)
Microsoft	N/A	Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft	Azure	Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 Azure Connect Feature Pack
Microsoft	N/A	Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (CU 4)
Microsoft	N/A	Skype pour Business Server 2019 CU7
Microsoft	N/A	Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (GDR)
Microsoft	N/A	Microsoft Dynamics 365 (on-premises) version 9.1
Microsoft	N/A	Skype pour Business Server 2015 CU13
Microsoft	N/A	Microsoft 365 Apps pour Enterprise pour systèmes 32 bits
Microsoft	N/A	Microsoft 365 Apps pour Enterprise pour 64 bits Systems
Microsoft	N/A	Microsoft SQL Server 2017 pour systèmes x64 (GDR)
Microsoft	N/A	Microsoft SQL Server 2017 pour systèmes x64 (CU 31)
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.4
Microsoft	N/A	Microsoft SQL Server 2019 pour systèmes x64 (GDR)
Microsoft	N/A	Microsoft ODBC Driver 18 pour SQL Server on MacOS
Microsoft	N/A	Microsoft SQL Server 2019 pour systèmes x64 (CU 22)
Microsoft	N/A	Microsoft ODBC Driver 17 pour SQL Server on MacOS
Microsoft	N/A	Microsoft Dynamics 365 (on-premises) version 9.0
Microsoft	N/A	Microsoft Common Data Model SDK pour TypeScript
Microsoft	N/A	Microsoft SQL Server 2022 pour systèmes x64 (CU 8)
Microsoft	N/A	Microsoft Common Data Model SDK pour Java
Microsoft	N/A	Microsoft ODBC Driver 17 pour SQL Server on Linux
Microsoft	N/A	Microsoft Exchange Server 2019 Cumulative Update 12
Microsoft	N/A	Microsoft OLE DB Driver 18 pour SQL Server
Microsoft	N/A	Microsoft ODBC Driver 18 pour SQL Server on Linux
Microsoft	N/A	Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (GDR)
Microsoft	N/A	Microsoft Common Data Model SDK pour Python

References

Title

Publication Time

CNVD-2023-92203

Vulnerability from cnvd - Published: 2023-11-29

Title

Microsoft Skype for Business远程代码执行漏洞（CNVD-2023-92203）

Description

Microsoft Skype for Business Server是美国微软（Microsoft）公司的一套安全统一的通信平台，它提供即时消息(IM)、音频和视频通话、联机会议、联机状态信息和共享功能。 Microsoft Skype for Business存在远程代码执行漏洞，攻击者可利用该漏洞在系统上执行任意代码。

Severity

高

Patch Name

Microsoft Skype for Business远程代码执行漏洞（CNVD-2023-92203）的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780

Reference

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780

Impacted products

Name
['Microsoft Skype for Business Server 2015 CU13', 'Microsoft Skype for Business Server 2019 CU7']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-36780",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-36780"
    }
  },
  "description": "Microsoft Skype for Business Server\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u5957\u5b89\u5168\u7edf\u4e00\u7684\u901a\u4fe1\u5e73\u53f0\uff0c\u5b83\u63d0\u4f9b\u5373\u65f6\u6d88\u606f(IM)\u3001\u97f3\u9891\u548c\u89c6\u9891\u901a\u8bdd\u3001\u8054\u673a\u4f1a\u8bae\u3001\u8054\u673a\u72b6\u6001\u4fe1\u606f\u548c\u5171\u4eab\u529f\u80fd\u3002\n\nMicrosoft Skype for Business\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2023-92203",
  "openTime": "2023-11-29",
  "patchDescription": "Microsoft Skype for Business Server\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u5957\u5b89\u5168\u7edf\u4e00\u7684\u901a\u4fe1\u5e73\u53f0\uff0c\u5b83\u63d0\u4f9b\u5373\u65f6\u6d88\u606f(IM)\u3001\u97f3\u9891\u548c\u89c6\u9891\u901a\u8bdd\u3001\u8054\u673a\u4f1a\u8bae\u3001\u8054\u673a\u72b6\u6001\u4fe1\u606f\u548c\u5171\u4eab\u529f\u80fd\u3002\r\n\r\nMicrosoft Skype for Business\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft Skype for Business\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CNVD-2023-92203\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Microsoft Skype for Business Server 2015 CU13",
      "Microsoft Skype for Business Server 2019 CU7"
    ]
  },
  "referenceLink": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780",
  "serverity": "\u9ad8",
  "submitTime": "2023-10-13",
  "title": "Microsoft Skype for Business\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CNVD-2023-92203\uff09"
}

FKIE_CVE-2023-36780

Vulnerability from fkie_nvd - Published: 2023-10-10 18:15 - Updated: 2024-11-21 08:10

Severity

7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

Skype for Business Remote Code Execution Vulnerability

References

	URL	Tags
	secure@microsoft.com	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780	Patch, Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780	Patch, Vendor Advisory

Impacted products

	Vendor	Product	Version
	microsoft	skype_for_business_server	2015
	microsoft	skype_for_business_server	2019

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13:*:*:*:*:*:*",
              "matchCriteriaId": "590D1547-C998-4BDD-BE06-379099E2D9C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_7:*:*:*:*:*:*",
              "matchCriteriaId": "4172BD0D-5F18-4E0C-8BAF-72A052432B2B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Skype for Business Remote Code Execution Vulnerability"
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo de Skype Empresarial"
    }
  ],
  "id": "CVE-2023-36780",
  "lastModified": "2024-11-21T08:10:35.203",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "secure@microsoft.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2023-10-10T18:15:17.587",
  "references": [
    {
      "source": "secure@microsoft.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-426"
        }
      ],
      "source": "secure@microsoft.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-CPXX-4QWP-7XPQ

Vulnerability from github – Published: 2023-10-10 18:31 – Updated: 2024-04-04 08:32

Details

Skype for Business Remote Code Execution Vulnerability

Severity

7.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-36780"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-10T18:15:17Z",
    "severity": "HIGH"
  },
  "details": "Skype for Business Remote Code Execution Vulnerability",
  "id": "GHSA-cpxx-4qwp-7xpq",
  "modified": "2024-04-04T08:32:30Z",
  "published": "2023-10-10T18:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36780"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2023-36780

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Skype for Business Remote Code Execution Vulnerability

Aliases

CVE-2023-36780

Aliases

CVE-2023-36780

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-36780",
    "id": "GSD-2023-36780"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-36780"
      ],
      "details": "Skype for Business Remote Code Execution Vulnerability",
      "id": "GSD-2023-36780",
      "modified": "2023-12-13T01:20:34.444148Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secure@microsoft.com",
        "ID": "CVE-2023-36780",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Skype for Business Server 2019 CU7",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "2046.0",
                          "version_value": "7.0.246.530"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Skype for Business Server 2015 CU13",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "9319.0",
                          "version_value": "6.0.9319.869"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Microsoft"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Skype for Business Remote Code Execution Vulnerability"
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Remote Code Execution"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780",
            "refsource": "MISC",
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_7:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2023-36780"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Skype for Business Remote Code Execution Vulnerability"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-10-12T22:22Z",
      "publishedDate": "2023-10-10T18:15Z"
    }
  }
}

MSRC_CVE-2023-36780

Vulnerability from csaf_microsoft - Published: 2023-10-10 07:00 - Updated: 2023-10-10 07:00

Summary

Skype for Business Remote Code Execution Vulnerability

Severity

Important

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Customer Action: Required. The vulnerability documented by this CVE requires customer action to resolve.

CVE-2023-36780

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CWE-426 - Untrusted Search Path

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Skype for Business Server 2019 CU7 7.0.246.530 Skype for Business Server 2019 CU7		7.0.246.530
Skype for Business Server 2015 CU13 6.0.9319.869 Skype for Business Server 2015 CU13		6.0.9319.869

Known affected 2 products

Product	Identifier	Version	Remediation
Skype for Business Server 2015 CU13 <6.0.9319.869 Skype for Business Server 2015 CU13		<6.0.9319.869	Vendor Fix fix
Skype for Business Server 2019 CU7 <7.0.246.530 Skype for Business Server 2019 CU7		<7.0.246.530	Vendor Fix fix

Threats

Impact Remote Code Execution

Exploit Status Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely

References

7 references

URL	Category
https://msrc.microsoft.com/update-guide/vulnerabi…	self
https://msrc.microsoft.com/csaf/advisories/2023/m…	self
https://www.microsoft.com/en-us/msrc/exploitabili…	external
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/update-guide/vulnerabi…	self
https://msrc.microsoft.com/csaf/advisories/2023/m…	self

Acknowledgments

Anonymous

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Anonymous"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2023-36780 Skype for Business Remote Code Execution Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780"
      },
      {
        "category": "self",
        "summary": "CVE-2023-36780 Skype for Business Remote Code Execution Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/advisories/2023/msrc_cve-2023-36780.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Skype for Business Remote Code Execution Vulnerability",
    "tracking": {
      "current_release_date": "2023-10-10T07:00:00.000Z",
      "generator": {
        "date": "2025-04-14T22:45:46.695Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2023-36780",
      "initial_release_date": "2023-10-10T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2023-10-10T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c7.0.246.530",
            "product": {
              "name": "Skype for Business Server 2019 CU7 \u003c7.0.246.530",
              "product_id": "2"
            }
          },
          {
            "category": "product_version",
            "name": "7.0.246.530",
            "product": {
              "name": "Skype for Business Server 2019 CU7 7.0.246.530",
              "product_id": "12223"
            }
          }
        ],
        "category": "product_name",
        "name": "Skype for Business Server 2019 CU7"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c6.0.9319.869",
            "product": {
              "name": "Skype for Business Server 2015 CU13 \u003c6.0.9319.869",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "6.0.9319.869",
            "product": {
              "name": "Skype for Business Server 2015 CU13 6.0.9319.869",
              "product_id": "12224"
            }
          }
        ],
        "category": "product_name",
        "name": "Skype for Business Server 2015 CU13"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-36780",
      "cwe": {
        "id": "CWE-426",
        "name": "Untrusted Search Path"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "To exploit this input validation vulnerability, an attacker would need access to an authenticated user account holding CsHelpDesk administrative privileges, hosting a malicious C++/CLI assembly in the shared directory.\nThe attacker would also need to create a remote PowerShell session in order to run the insecure Get-Help cmdlet at server context.\nThis exploit would allow the attacker to gain remote code execution on the Skype for Business Server backend.",
          "title": "How could an attacker exploit this vulnerability?"
        },
        {
          "category": "faq",
          "text": "Successful exploitation of this vulnerability requires the attacker or targeted user to be granted an administrative role in the Skype for Business Control Panel.\nTo help retain security and role-based access control integrity, add users to the groups that define what role the user performs in management of the Skype for Business Server deployment.",
          "title": "According to the CVSS metric, privileges required is high (PR:H). What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "The vulnerability exists in PowerShell when exposed through Microsoft Exchange or Skype. This occurs when someone creates a custom endpoint, called restricted remoting, that exposes the \u0026quot;GetHelp\u0026quot; command without a proxy that validates the input.",
          "title": "If I\u2019m running PowerShell, how am I exposed to this vulnerability?"
        }
      ],
      "product_status": {
        "fixed": [
          "12223",
          "12224"
        ],
        "known_affected": [
          "1",
          "2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-36780 Skype for Business Remote Code Execution Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780"
        },
        {
          "category": "self",
          "summary": "CVE-2023-36780 Skype for Business Remote Code Execution Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/csaf/advisories/2023/msrc_cve-2023-36780.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-10-10T07:00:00.000Z",
          "details": "7.0.246.530:Security Update:https://support.microsoft.com/help/4470124",
          "product_ids": [
            "2"
          ],
          "url": "https://support.microsoft.com/help/4470124"
        },
        {
          "category": "vendor_fix",
          "date": "2023-10-10T07:00:00.000Z",
          "details": "6.0.9319.869:Security Update:https://support.microsoft.com/help/3061064",
          "product_ids": [
            "1"
          ],
          "url": "https://support.microsoft.com/help/3061064"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.3,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Remote Code Execution"
        },
        {
          "category": "exploit_status",
          "details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely"
        }
      ],
      "title": "Skype for Business Remote Code Execution Vulnerability"
    }
  ]
}

WID-SEC-W-2023-2608

Vulnerability from csaf_certbund - Published: 2023-10-10 22:00 - Updated: 2023-10-10 22:00

Summary

Microsoft Office: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Microsoft 365 Apps ist eine Office Suite für zahlreiche Büroanwendungen. Die Microsoft Office Suite beinhaltet zahlreiche Büroanwendungen wie Textverarbeitung, Tabellenkalkulation, Datenbank und weitere Applikationen. Skype ist ein Instant-Messaging-Dienst. Unterstützt werden Videokonferenzen, IP-Telefonie, Instant-Messaging, Dateiübertragung und Screen-Sharing.

Angriff: Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Microsoft Office ausnutzen, um seine Privilegien zu erhöhen und beliebigen Code auszuführen.

Betroffene Betriebssysteme: - Windows

CVE-2023-41763

Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchführung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse auslösen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuführen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erhöhte Rechte.

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

CVE-2023-36789

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

CVE-2023-36786

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

CVE-2023-36780

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

CVE-2023-36569

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

CVE-2023-36568

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

CVE-2023-36565

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

References

3 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://msrc.microsoft.com/update-guide	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Microsoft 365 Apps ist eine Office Suite f\u00fcr zahlreiche B\u00fcroanwendungen.\r\nDie Microsoft Office Suite beinhaltet zahlreiche B\u00fcroanwendungen wie Textverarbeitung, Tabellenkalkulation, Datenbank und weitere Applikationen.\r\nSkype ist ein Instant-Messaging-Dienst. Unterst\u00fctzt werden Videokonferenzen, IP-Telefonie, Instant-Messaging, Datei\u00fcbertragung und Screen-Sharing.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Microsoft Office ausnutzen, um seine Privilegien zu erh\u00f6hen und beliebigen Code auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-2608 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2608.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-2608 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2608"
      },
      {
        "category": "external",
        "summary": "Microsoft Leitfaden f\u00fcr Sicherheitsupdates vom 2023-10-10",
        "url": "https://msrc.microsoft.com/update-guide"
      }
    ],
    "source_lang": "en-US",
    "title": "Microsoft Office: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2023-10-10T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:59:39.815+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-2608",
      "initial_release_date": "2023-10-10T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-10-10T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Microsoft 365 Apps",
            "product": {
              "name": "Microsoft 365 Apps",
              "product_id": "T016910",
              "product_identification_helper": {
                "cpe": "cpe:/a:microsoft:365_apps:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Microsoft Office LTSC for Mac 2021",
                "product": {
                  "name": "Microsoft Office LTSC for Mac 2021",
                  "product_id": "T020985",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:office:ltsc_for_mac_2021"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Microsoft Office for Android",
                "product": {
                  "name": "Microsoft Office for Android",
                  "product_id": "T026296",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:office:for_android"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Microsoft Office for Universal",
                "product": {
                  "name": "Microsoft Office for Universal",
                  "product_id": "T026297",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:office:for_universal"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Microsoft Office LTSC 2021",
                "product": {
                  "name": "Microsoft Office LTSC 2021",
                  "product_id": "T029334",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:office:ltsc_2021"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Office"
          },
          {
            "category": "product_name",
            "name": "Microsoft Office 2019",
            "product": {
              "name": "Microsoft Office 2019",
              "product_id": "T014534",
              "product_identification_helper": {
                "cpe": "cpe:/a:microsoft:office_2019:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Microsoft Office 2019 for Mac",
            "product": {
              "name": "Microsoft Office 2019 for Mac",
              "product_id": "T014533",
              "product_identification_helper": {
                "cpe": "cpe:/a:microsoft:office_2019_for_mac:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Microsoft Skype for Business Server 2015 CU13",
                "product": {
                  "name": "Microsoft Skype for Business Server 2015 CU13",
                  "product_id": "T030376",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:skype:for_business_server_2015_cu13"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Microsoft Skype for Business Server 2019 CU7",
                "product": {
                  "name": "Microsoft Skype for Business Server 2019 CU7",
                  "product_id": "T030377",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:skype:for_business_server_2019_cu7"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Skype"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-41763",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-41763"
    },
    {
      "cve": "CVE-2023-36789",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-36789"
    },
    {
      "cve": "CVE-2023-36786",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-36786"
    },
    {
      "cve": "CVE-2023-36780",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-36780"
    },
    {
      "cve": "CVE-2023-36569",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-36569"
    },
    {
      "cve": "CVE-2023-36568",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-36568"
    },
    {
      "cve": "CVE-2023-36565",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-36565"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2023-36780 (GCVE-0-2023-36780)

Solution

Solution

Tags

Sightings

Nomenclature