Vulnerability · Published Jul 14, 2020 · Assigned by microsoft
CVE-2020-1025Microsoft Office Elevation of Privilege Vulnerability
Critical 9.8
In plain English
A critical-severity security flaw in Microsoft Lync Server 2013 from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.9% (higher than 93% of all known vulnerabilities).
Official description
An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation. An attacker who successfully exploited the vulnerability could bypass authentication and achieve improper access. To exploit this vulnerability, an attacker would need to modify the token. The update addresses the vulnerability by modifying how Microsoft SharePoint Server and Skype for Business Server validate tokens.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Skype for Business Server 2019 CU2 | 7.0.0 – before publication |
| Microsoft | Skype for Business Server 2015 CU 8 | 2015 CU 8 – before publication |
| Microsoft | Microsoft Lync Server 2013 | 0 – before publication |
| Microsoft | Microsoft SharePoint Enterprise Server 2016 | 16.0.0 – before publication |
| Microsoft | Microsoft SharePoint Server 2019 | 16.0.0 – before publication |
| Microsoft | Microsoft SharePoint Foundation 2013 Service Pack 1 | 15.0.0 – before publication |