Actively exploited · Published Oct 10, 2023 · Assigned by microsoft
CVE-2023-41763Skype for Business Elevation of Privilege Vulnerability
Medium 5.3 Exploited
In plain English
A medium-severity server-side request forgery in Skype for Business Server 2015 CU13 from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on October 10, 2023). The chance it is exploited in the next 30 days is estimated at 90.3% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Oct 31, 2023.
Official description
Skype for Business Elevation of Privilege Vulnerability
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Skype for Business Server 2015 CU13 | 9319.0 – before 6.0.9319.869 |
| Microsoft | Skype for Business Server 2019 CU7 | 2046.0 – before 7.0.246.530 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
References
- Skype for Business Elevation of Privilege Vulnerability vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41763 government-resource