Vulnerability-Lookup

CVE-2023-41763 (GCVE-0-2023-41763)

Vulnerability from cvelistv5 – Published: 2023-10-10 17:07 – Updated: 2025-10-21 23:05

CISA KEV KEVintel KEV

Title

Skype for Business Elevation of Privilege Vulnerability

Summary

Skype for Business Elevation of Privilege Vulnerability

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

SSVC

Exploitation: active Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

microsoft

References

2 references

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

2 products

Vendor	Product	Version
Microsoft	Skype for Business Server 2015 CU13	Affected: 9319.0 , < 6.0.9319.869 (custom)
Microsoft	Skype for Business Server 2019 CU7	Affected: 2046.0 , < 7.0.246.530 (custom)

Date Public

2023-10-10 07:00

CISA KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: de69649c-6854-43a2-8738-5fabb8e829ea

Vulnerability ID: CVE-2023-41763

Status: Confirmed

Status Updated: 2023-10-10 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2023-10-10

Asserted: 2023-10-10

Scope

Notes: KEV entry: Microsoft Skype for Business Privilege Escalation Vulnerability | Affected: Microsoft / Skype for Business | Description: Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-10-31 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-41763; https://nvd.nist.gov/vuln/detail/CVE-2023-41763

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-918
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	Skype for Business
Due Date	2023-10-31
Date Added	2023-10-10
Vendorproject	Microsoft
Vulnerabilityname	Microsoft Skype for Business Privilege Escalation Vulnerability
Knownransomwarecampaignuse	Unknown

References

CVE-2023-41763

Created: 2026-02-02 12:26 UTC | Updated: 2026-02-06 07:17 UTC

KEVintel KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 215ca057-a52d-43d1-b49d-7ca0a685cab7

Vulnerability ID: CVE-2023-41763

Status: Confirmed

Status Updated: 2023-10-10 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2023-10-10

Asserted: 2023-10-10

Scope

Notes: KEVIntel entry: Skype for Business Elevation of Privilege Vulnerability | Affected: Microsoft / Skype for Business Server 2015 CU13, Skype for Business Server 2019 CU7 | CVSS: 5.3 (MEDIUM) | Used in malware: unknown | Not yet in CISA KEV: False

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details

Feed	KEVIntel (kevintel.com)
Title	Skype for Business Elevation of Privilege Vulnerability
Vendor	Microsoft
Product	Skype for Business Server 2015 CU13, Skype for Business Server 2019 CU7
Added Date	2023-10-10T00:00:00.000Z
Cvss Score	5.3
Epss Score	None
Cvss Severity	MEDIUM
Epss Percentile	None
Used In Malware	unknown
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	False

References

Created: 2026-06-19 12:46 UTC | Updated: 2026-06-19 12:46 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41763",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-16T20:26:59.238274Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2023-10-10",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41763"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:05:34.874Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41763"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2023-10-10T00:00:00.000Z",
            "value": "CVE-2023-41763 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:09:47.991Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Skype for Business Elevation of Privilege Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Skype for Business Server 2015 CU13",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.0.9319.869",
              "status": "affected",
              "version": "9319.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Skype for Business Server 2019 CU7",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "7.0.246.530",
              "status": "affected",
              "version": "2046.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:skype_for_business_server:*:cu13:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.9319.869",
                  "versionStartIncluding": "9319.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:skype_for_business_server:*:cu7:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.246.530",
                  "versionStartIncluding": "2046.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-10-10T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Skype for Business Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-14T22:45:50.701Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Skype for Business Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763"
        }
      ],
      "title": "Skype for Business Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-41763",
    "datePublished": "2023-10-10T17:07:24.950Z",
    "dateReserved": "2023-08-31T23:08:32.064Z",
    "dateUpdated": "2025-10-21T23:05:34.874Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2023-41763",
      "cwes": "[\"CWE-918\"]",
      "dateAdded": "2023-10-10",
      "dueDate": "2023-10-31",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-41763;   https://nvd.nist.gov/vuln/detail/CVE-2023-41763",
      "product": "Skype for Business",
      "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation.",
      "vendorProject": "Microsoft",
      "vulnerabilityName": "Microsoft Skype for Business Privilege Escalation Vulnerability"
    },
    "epss": {
      "cve": "CVE-2023-41763",
      "date": "2026-06-19",
      "epss": "0.90353",
      "percentile": "0.99785"
    },
    "fkie_nvd": {
      "cisaActionDue": "2023-10-31",
      "cisaExploitAdd": "2023-10-10",
      "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
      "cisaVulnerabilityName": "Microsoft Skype for Business Privilege Escalation Vulnerability",
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13:*:*:*:*:*:*\", \"matchCriteriaId\": \"590D1547-C998-4BDD-BE06-379099E2D9C7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_7:*:*:*:*:*:*\", \"matchCriteriaId\": \"4172BD0D-5F18-4E0C-8BAF-72A052432B2B\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Skype for Business Elevation of Privilege Vulnerability\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad de elevaci\\u00f3n de privilegios en Skype Empresarial\"}]",
      "id": "CVE-2023-41763",
      "lastModified": "2024-11-29T14:36:59.690",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"secure@microsoft.com\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}]}",
      "published": "2023-10-10T18:15:18.150",
      "references": "[{\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763\", \"source\": \"secure@microsoft.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "secure@microsoft.com",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"secure@microsoft.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-918\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-918\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-41763\",\"sourceIdentifier\":\"secure@microsoft.com\",\"published\":\"2023-10-10T18:15:18.150\",\"lastModified\":\"2025-10-28T14:10:39.503\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Skype for Business Elevation of Privilege Vulnerability\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de elevaci\u00f3n de privilegios en Skype Empresarial\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"cisaExploitAdd\":\"2023-10-10\",\"cisaActionDue\":\"2023-10-31\",\"cisaRequiredAction\":\"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\",\"cisaVulnerabilityName\":\"Microsoft Skype for Business Privilege Escalation Vulnerability\",\"weaknesses\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13:*:*:*:*:*:*\",\"matchCriteriaId\":\"590D1547-C998-4BDD-BE06-379099E2D9C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_7:*:*:*:*:*:*\",\"matchCriteriaId\":\"4172BD0D-5F18-4E0C-8BAF-72A052432B2B\"}]}]}],\"references\":[{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41763\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763\", \"name\": \"Skype for Business Elevation of Privilege Vulnerability\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T19:09:47.991Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-41763\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-16T20:26:59.238274Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2023-10-10\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41763\"}}}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2023-10-10T00:00:00+00:00\", \"value\": \"CVE-2023-41763 added to CISA KEV\"}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41763\", \"tags\": [\"government-resource\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-09T20:25:52.729Z\"}}], \"cna\": {\"title\": \"Skype for Business Elevation of Privilege Vulnerability\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C\"}, \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Microsoft\", \"product\": \"Skype for Business Server 2015 CU13\", \"versions\": [{\"status\": \"affected\", \"version\": \"9319.0\", \"lessThan\": \"6.0.9319.869\", \"versionType\": \"custom\"}], \"platforms\": [\"Unknown\"]}, {\"vendor\": \"Microsoft\", \"product\": \"Skype for Business Server 2019 CU7\", \"versions\": [{\"status\": \"affected\", \"version\": \"2046.0\", \"lessThan\": \"7.0.246.530\", \"versionType\": \"custom\"}], \"platforms\": [\"Unknown\"]}], \"datePublic\": \"2023-10-10T07:00:00.000Z\", \"references\": [{\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763\", \"name\": \"Skype for Business Elevation of Privilege Vulnerability\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en-US\", \"value\": \"Skype for Business Elevation of Privilege Vulnerability\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en-US\", \"type\": \"CWE\", \"cweId\": \"CWE-918\", \"description\": \"CWE-918: Server-Side Request Forgery (SSRF)\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:microsoft:skype_for_business_server:*:cu13:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.0.9319.869\", \"versionStartIncluding\": \"9319.0\"}, {\"criteria\": \"cpe:2.3:a:microsoft:skype_for_business_server:*:cu7:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.0.246.530\", \"versionStartIncluding\": \"2046.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"shortName\": \"microsoft\", \"dateUpdated\": \"2025-04-14T22:45:50.701Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-41763\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-21T23:05:34.874Z\", \"dateReserved\": \"2023-08-31T23:08:32.064Z\", \"assignerOrgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"datePublished\": \"2023-10-10T17:07:24.950Z\", \"assignerShortName\": \"microsoft\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CERTFR-2023-AVI-0830

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer une élévation de privilèges, une usurpation d'identité, une exécution de code à distance, un déni de service et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Microsoft	N/A	Microsoft Exchange Server 2019 Cumulative Update 13
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.2
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.7
Microsoft	N/A	Microsoft OLE DB Driver 19 pour SQL Server
Microsoft	N/A	Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (CU 4)
Microsoft	N/A	Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 (GDR)
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.6
Microsoft	N/A	Microsoft Common Data Model SDK pour C#
Microsoft	N/A	Microsoft SQL Server 2022 pour systèmes x64 (GDR)
Microsoft	N/A	Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft	Azure	Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 Azure Connect Feature Pack
Microsoft	N/A	Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (CU 4)
Microsoft	N/A	Skype pour Business Server 2019 CU7
Microsoft	N/A	Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (GDR)
Microsoft	N/A	Microsoft Dynamics 365 (on-premises) version 9.1
Microsoft	N/A	Skype pour Business Server 2015 CU13
Microsoft	N/A	Microsoft 365 Apps pour Enterprise pour systèmes 32 bits
Microsoft	N/A	Microsoft 365 Apps pour Enterprise pour 64 bits Systems
Microsoft	N/A	Microsoft SQL Server 2017 pour systèmes x64 (GDR)
Microsoft	N/A	Microsoft SQL Server 2017 pour systèmes x64 (CU 31)
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.4
Microsoft	N/A	Microsoft SQL Server 2019 pour systèmes x64 (GDR)
Microsoft	N/A	Microsoft ODBC Driver 18 pour SQL Server on MacOS
Microsoft	N/A	Microsoft SQL Server 2019 pour systèmes x64 (CU 22)
Microsoft	N/A	Microsoft ODBC Driver 17 pour SQL Server on MacOS
Microsoft	N/A	Microsoft Dynamics 365 (on-premises) version 9.0
Microsoft	N/A	Microsoft Common Data Model SDK pour TypeScript
Microsoft	N/A	Microsoft SQL Server 2022 pour systèmes x64 (CU 8)
Microsoft	N/A	Microsoft Common Data Model SDK pour Java
Microsoft	N/A	Microsoft ODBC Driver 17 pour SQL Server on Linux
Microsoft	N/A	Microsoft Exchange Server 2019 Cumulative Update 12
Microsoft	N/A	Microsoft OLE DB Driver 18 pour SQL Server
Microsoft	N/A	Microsoft ODBC Driver 18 pour SQL Server on Linux
Microsoft	N/A	Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (GDR)
Microsoft	N/A	Microsoft Common Data Model SDK pour Python

References

Title

Publication Time

CERTFR-2023-AVI-0830

Vulnerability from certfr_avis - Published: - Updated:

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Microsoft	N/A	Microsoft Exchange Server 2019 Cumulative Update 13
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.2
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.7
Microsoft	N/A	Microsoft OLE DB Driver 19 pour SQL Server
Microsoft	N/A	Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (CU 4)
Microsoft	N/A	Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 (GDR)
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.6
Microsoft	N/A	Microsoft Common Data Model SDK pour C#
Microsoft	N/A	Microsoft SQL Server 2022 pour systèmes x64 (GDR)
Microsoft	N/A	Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft	Azure	Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 Azure Connect Feature Pack
Microsoft	N/A	Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (CU 4)
Microsoft	N/A	Skype pour Business Server 2019 CU7
Microsoft	N/A	Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (GDR)
Microsoft	N/A	Microsoft Dynamics 365 (on-premises) version 9.1
Microsoft	N/A	Skype pour Business Server 2015 CU13
Microsoft	N/A	Microsoft 365 Apps pour Enterprise pour systèmes 32 bits
Microsoft	N/A	Microsoft 365 Apps pour Enterprise pour 64 bits Systems
Microsoft	N/A	Microsoft SQL Server 2017 pour systèmes x64 (GDR)
Microsoft	N/A	Microsoft SQL Server 2017 pour systèmes x64 (CU 31)
Microsoft	N/A	Microsoft Visual Studio 2022 version 17.4
Microsoft	N/A	Microsoft SQL Server 2019 pour systèmes x64 (GDR)
Microsoft	N/A	Microsoft ODBC Driver 18 pour SQL Server on MacOS
Microsoft	N/A	Microsoft SQL Server 2019 pour systèmes x64 (CU 22)
Microsoft	N/A	Microsoft ODBC Driver 17 pour SQL Server on MacOS
Microsoft	N/A	Microsoft Dynamics 365 (on-premises) version 9.0
Microsoft	N/A	Microsoft Common Data Model SDK pour TypeScript
Microsoft	N/A	Microsoft SQL Server 2022 pour systèmes x64 (CU 8)
Microsoft	N/A	Microsoft Common Data Model SDK pour Java
Microsoft	N/A	Microsoft ODBC Driver 17 pour SQL Server on Linux
Microsoft	N/A	Microsoft Exchange Server 2019 Cumulative Update 12
Microsoft	N/A	Microsoft OLE DB Driver 18 pour SQL Server
Microsoft	N/A	Microsoft ODBC Driver 18 pour SQL Server on Linux
Microsoft	N/A	Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (GDR)
Microsoft	N/A	Microsoft Common Data Model SDK pour Python

References

Title

Publication Time

BDU:2023-06768

Vulnerability from fstec - Published: 10.10.2023

Title

Уязвимость программы мгновенного обмена сообщениями Skype for Business Server, связанная с отсутствием защиты служебных данных, позволяющая нарушителю раскрыть защищаемую информацию

Description

Уязвимость программы мгновенного обмена сообщениями Skype for Business Server связана с отсутствием защиты служебных данных. Эксплуатация уязвимости может позволить нарушителю раскрыть защищаемую информацию

Severity


                    
                      AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Vendor

Microsoft Corp

Software Name

Skype for Business Server

Software Version

2019 CU7 (Skype for Business Server), 2015 CU13 (Skype for Business Server)

Possible Mitigations

Использование рекомендаций: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763

Reference

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763 https://ru.secnews.gr/486403/microsoft-patch-tuesday-oktobriou-2023-diorthonei-104-bugs/

CWE

CWE-200

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Microsoft Corp",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "2019 CU7 (Skype for Business Server), 2015 CU13 (Skype for Business Server)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "10.10.2023",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "16.10.2023",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "16.10.2023",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2023-06768",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2023-41763",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Skype for Business Server",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u043c\u0435\u043d\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 Skype for Business Server, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u043b\u0443\u0436\u0435\u0431\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 (CWE-200)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u043c\u0435\u043d\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 Skype for Business Server \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u043b\u0443\u0436\u0435\u0431\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0431\u043e\u0440 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763\nhttps://ru.secnews.gr/486403/microsoft-patch-tuesday-oktobriou-2023-diorthonei-104-bugs/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-200",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,3)"
}

CNVD-2023-92201

Vulnerability from cnvd - Published: 2023-11-29

Title

Microsoft Skype for Business权限提升漏洞（CNVD-2023-92201）

Description

Microsoft Skype for Business Server是美国微软（Microsoft）公司的一套安全统一的通信平台，它提供即时消息(IM)、音频和视频通话、联机会议、联机状态信息和共享功能。 Microsoft Skype for Business存在权限提升漏洞，攻击者可利用该漏洞以更高的权限获取敏感信息。

Severity

中

Patch Name

Microsoft Skype for Business权限提升漏洞（CNVD-2023-92201）的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763

Reference

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763

Impacted products

Name
['Microsoft Skype for Business Server 2015 CU13', 'Microsoft Skype for Business Server 2019 CU7']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-41763",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-41763"
    }
  },
  "description": "Microsoft Skype for Business Server\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u5957\u5b89\u5168\u7edf\u4e00\u7684\u901a\u4fe1\u5e73\u53f0\uff0c\u5b83\u63d0\u4f9b\u5373\u65f6\u6d88\u606f(IM)\u3001\u97f3\u9891\u548c\u89c6\u9891\u901a\u8bdd\u3001\u8054\u673a\u4f1a\u8bae\u3001\u8054\u673a\u72b6\u6001\u4fe1\u606f\u548c\u5171\u4eab\u529f\u80fd\u3002\n\nMicrosoft Skype for Business\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5\u66f4\u9ad8\u7684\u6743\u9650\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2023-92201",
  "openTime": "2023-11-29",
  "patchDescription": "Microsoft Skype for Business Server\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u5957\u5b89\u5168\u7edf\u4e00\u7684\u901a\u4fe1\u5e73\u53f0\uff0c\u5b83\u63d0\u4f9b\u5373\u65f6\u6d88\u606f(IM)\u3001\u97f3\u9891\u548c\u89c6\u9891\u901a\u8bdd\u3001\u8054\u673a\u4f1a\u8bae\u3001\u8054\u673a\u72b6\u6001\u4fe1\u606f\u548c\u5171\u4eab\u529f\u80fd\u3002\r\n\r\nMicrosoft Skype for Business\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5\u66f4\u9ad8\u7684\u6743\u9650\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft Skype for Business\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2023-92201\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Microsoft Skype for Business Server 2015 CU13",
      "Microsoft Skype for Business Server 2019 CU7"
    ]
  },
  "referenceLink": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763",
  "serverity": "\u4e2d",
  "submitTime": "2023-10-13",
  "title": "Microsoft Skype for Business\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2023-92201\uff09"
}

FKIE_CVE-2023-41763

Vulnerability from fkie_nvd - Published: 2023-10-10 18:15 - Updated: 2026-06-17 06:22

CISA KEV KEVintel KEV

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

Skype for Business Elevation of Privilege Vulnerability

References

URL	Tags
secure@microsoft.com	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763	Patch, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41763	US Government Resource

Impacted products

	Vendor	Product	Version
	microsoft	skype_for_business_server	2015
	microsoft	skype_for_business_server	2019

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Skype for Business Server 2015 CU13",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.0.9319.869",
              "status": "affected",
              "version": "9319.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Skype for Business Server 2019 CU7",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "7.0.246.530",
              "status": "affected",
              "version": "2046.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "secure@microsoft.com"
    }
  ],
  "cisaActionDue": "2023-10-31",
  "cisaExploitAdd": "2023-10-10",
  "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "Microsoft Skype for Business Privilege Escalation Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13:*:*:*:*:*:*",
              "matchCriteriaId": "590D1547-C998-4BDD-BE06-379099E2D9C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_7:*:*:*:*:*:*",
              "matchCriteriaId": "4172BD0D-5F18-4E0C-8BAF-72A052432B2B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Skype for Business Elevation of Privilege Vulnerability"
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de elevaci\u00f3n de privilegios en Skype Empresarial"
    }
  ],
  "id": "CVE-2023-41763",
  "lastModified": "2026-06-17T06:22:45.340",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "secure@microsoft.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-41763",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-07-16T20:26:59.238274Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-10-10T18:15:18.150",
  "references": [
    {
      "source": "secure@microsoft.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41763"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "secure@microsoft.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-7997-4R78-H34M

Vulnerability from github – Published: 2023-10-10 18:31 – Updated: 2025-10-22 00:32

Details

Skype for Business Elevation of Privilege Vulnerability

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-41763"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-10T18:15:18Z",
    "severity": "MODERATE"
  },
  "details": "Skype for Business Elevation of Privilege Vulnerability",
  "id": "GHSA-7997-4r78-h34m",
  "modified": "2025-10-22T00:32:51Z",
  "published": "2023-10-10T18:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41763"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41763"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2023-41763

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Skype for Business Elevation of Privilege Vulnerability

Aliases

CVE-2023-41763

Aliases

CVE-2023-41763

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-41763",
    "id": "GSD-2023-41763"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-41763"
      ],
      "details": "Skype for Business Elevation of Privilege Vulnerability",
      "id": "GSD-2023-41763",
      "modified": "2023-12-13T01:20:45.529212Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secure@microsoft.com",
        "ID": "CVE-2023-41763",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Skype for Business Server 2015 CU13",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "9319.0",
                          "version_value": "6.0.9319.869"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Skype for Business Server 2019 CU7",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "2046.0",
                          "version_value": "7.0.246.530"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Microsoft"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Skype for Business Elevation of Privilege Vulnerability"
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Elevation of Privilege"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763",
            "refsource": "MISC",
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_7:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2023-41763"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Skype for Business Elevation of Privilege Vulnerability"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4
        }
      },
      "lastModifiedDate": "2023-10-12T22:18Z",
      "publishedDate": "2023-10-10T18:15Z"
    }
  }
}

MSRC_CVE-2023-41763

Vulnerability from csaf_microsoft - Published: 2023-10-10 07:00 - Updated: 2023-10-10 07:00

Summary

Skype for Business Elevation of Privilege Vulnerability

Severity

Important

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Customer Action: Required. The vulnerability documented by this CVE requires customer action to resolve.

CVE-2023-41763

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

CWE-918 - Server-Side Request Forgery (SSRF)

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Skype for Business Server 2019 CU7 7.0.246.530 Skype for Business Server 2019 CU7		7.0.246.530
Skype for Business Server 2015 CU13 6.0.9319.869 Skype for Business Server 2015 CU13		6.0.9319.869

Known affected 2 products

Product	Identifier	Version	Remediation
Skype for Business Server 2015 CU13 <6.0.9319.869 Skype for Business Server 2015 CU13		<6.0.9319.869	Vendor Fix fix
Skype for Business Server 2019 CU7 <7.0.246.530 Skype for Business Server 2019 CU7		<7.0.246.530	Vendor Fix fix

Threats

Impact Elevation of Privilege

Exploit Status Publicly Disclosed:Yes;Exploited:Yes;Latest Software Release:Exploitation Detected

References

7 references

URL	Category
https://msrc.microsoft.com/update-guide/vulnerabi…	self
https://msrc.microsoft.com/csaf/advisories/2023/m…	self
https://www.microsoft.com/en-us/msrc/exploitabili…	external
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/update-guide/vulnerabi…	self
https://msrc.microsoft.com/csaf/advisories/2023/m…	self

Acknowledgments

Anonymous

Dr. Florian Hauser (@frycos) with Code White GmbH

Anonymous

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Anonymous"
        ]
      },
      {
        "names": [
          "Dr. Florian Hauser (@frycos) with Code White GmbH"
        ]
      },
      {
        "names": [
          "Anonymous"
        ]
      },
      {
        "names": [
          "Anonymous"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2023-41763 Skype for Business Elevation of Privilege Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763"
      },
      {
        "category": "self",
        "summary": "CVE-2023-41763 Skype for Business Elevation of Privilege Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/advisories/2023/msrc_cve-2023-41763.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Skype for Business Elevation of Privilege Vulnerability",
    "tracking": {
      "current_release_date": "2023-10-10T07:00:00.000Z",
      "generator": {
        "date": "2025-04-14T22:45:46.578Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2023-41763",
      "initial_release_date": "2023-10-10T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2023-10-10T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c6.0.9319.869",
            "product": {
              "name": "Skype for Business Server 2015 CU13 \u003c6.0.9319.869",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "6.0.9319.869",
            "product": {
              "name": "Skype for Business Server 2015 CU13 6.0.9319.869",
              "product_id": "12224"
            }
          }
        ],
        "category": "product_name",
        "name": "Skype for Business Server 2015 CU13"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c7.0.246.530",
            "product": {
              "name": "Skype for Business Server 2019 CU7 \u003c7.0.246.530",
              "product_id": "2"
            }
          },
          {
            "category": "product_version",
            "name": "7.0.246.530",
            "product": {
              "name": "Skype for Business Server 2019 CU7 7.0.246.530",
              "product_id": "12223"
            }
          }
        ],
        "category": "product_name",
        "name": "Skype for Business Server 2019 CU7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-41763",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "An attacker could make a specially crafted network call to the target Skype for Business server, which could cause the parsing of an http request made to an arbitrary address. This could disclose IP addresses or port numbers or both to the attacker.",
          "title": "How could an attacker exploit this vulnerability?"
        },
        {
          "category": "faq",
          "text": "An attacker who successfully exploited the vulnerability could view some sensitive information (Confidentiality) but not all resources within the impacted component may be divulged to the attacker. The attacker cannot make changes to disclosed information (Integrity) or limit access to the resource (Availability).",
          "title": "According to the CVSS metrics, successful exploitation of this vulnerability could lead to some loss of confidentiality (C:L) but have no effect on integrity (I:N) or on availability (A:N). What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "In some cases, the exposed sensitive information could provide access to internal networks.",
          "title": "If the successful attacker only could view some sensitive information, how is this an elevation of privilege vulnerability?"
        }
      ],
      "product_status": {
        "fixed": [
          "12223",
          "12224"
        ],
        "known_affected": [
          "1",
          "2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-41763 Skype for Business Elevation of Privilege Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763"
        },
        {
          "category": "self",
          "summary": "CVE-2023-41763 Skype for Business Elevation of Privilege Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/csaf/advisories/2023/msrc_cve-2023-41763.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-10-10T07:00:00.000Z",
          "details": "6.0.9319.869:Security Update:https://support.microsoft.com/help/3061064",
          "product_ids": [
            "1"
          ],
          "url": "https://support.microsoft.com/help/3061064"
        },
        {
          "category": "vendor_fix",
          "date": "2023-10-10T07:00:00.000Z",
          "details": "7.0.246.530:Security Update:https://support.microsoft.com/help/4470124",
          "product_ids": [
            "2"
          ],
          "url": "https://support.microsoft.com/help/4470124"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 4.8,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Elevation of Privilege"
        },
        {
          "category": "exploit_status",
          "details": "Publicly Disclosed:Yes;Exploited:Yes;Latest Software Release:Exploitation Detected"
        }
      ],
      "title": "Skype for Business Elevation of Privilege Vulnerability"
    }
  ]
}

WID-SEC-W-2023-2608

Vulnerability from csaf_certbund - Published: 2023-10-10 22:00 - Updated: 2023-10-10 22:00

Summary

Microsoft Office: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Microsoft 365 Apps ist eine Office Suite für zahlreiche Büroanwendungen. Die Microsoft Office Suite beinhaltet zahlreiche Büroanwendungen wie Textverarbeitung, Tabellenkalkulation, Datenbank und weitere Applikationen. Skype ist ein Instant-Messaging-Dienst. Unterstützt werden Videokonferenzen, IP-Telefonie, Instant-Messaging, Dateiübertragung und Screen-Sharing.

Angriff: Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Microsoft Office ausnutzen, um seine Privilegien zu erhöhen und beliebigen Code auszuführen.

Betroffene Betriebssysteme: - Windows

CVE-2023-41763

Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchführung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse auslösen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuführen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erhöhte Rechte.

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

CVE-2023-36789

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

CVE-2023-36786

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

CVE-2023-36780

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

CVE-2023-36569

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

CVE-2023-36568

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

CVE-2023-36565

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

References

3 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://msrc.microsoft.com/update-guide	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Microsoft 365 Apps ist eine Office Suite f\u00fcr zahlreiche B\u00fcroanwendungen.\r\nDie Microsoft Office Suite beinhaltet zahlreiche B\u00fcroanwendungen wie Textverarbeitung, Tabellenkalkulation, Datenbank und weitere Applikationen.\r\nSkype ist ein Instant-Messaging-Dienst. Unterst\u00fctzt werden Videokonferenzen, IP-Telefonie, Instant-Messaging, Datei\u00fcbertragung und Screen-Sharing.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Microsoft Office ausnutzen, um seine Privilegien zu erh\u00f6hen und beliebigen Code auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-2608 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2608.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-2608 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2608"
      },
      {
        "category": "external",
        "summary": "Microsoft Leitfaden f\u00fcr Sicherheitsupdates vom 2023-10-10",
        "url": "https://msrc.microsoft.com/update-guide"
      }
    ],
    "source_lang": "en-US",
    "title": "Microsoft Office: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2023-10-10T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:59:39.815+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-2608",
      "initial_release_date": "2023-10-10T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-10-10T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Microsoft 365 Apps",
            "product": {
              "name": "Microsoft 365 Apps",
              "product_id": "T016910",
              "product_identification_helper": {
                "cpe": "cpe:/a:microsoft:365_apps:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Microsoft Office LTSC for Mac 2021",
                "product": {
                  "name": "Microsoft Office LTSC for Mac 2021",
                  "product_id": "T020985",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:office:ltsc_for_mac_2021"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Microsoft Office for Android",
                "product": {
                  "name": "Microsoft Office for Android",
                  "product_id": "T026296",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:office:for_android"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Microsoft Office for Universal",
                "product": {
                  "name": "Microsoft Office for Universal",
                  "product_id": "T026297",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:office:for_universal"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Microsoft Office LTSC 2021",
                "product": {
                  "name": "Microsoft Office LTSC 2021",
                  "product_id": "T029334",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:office:ltsc_2021"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Office"
          },
          {
            "category": "product_name",
            "name": "Microsoft Office 2019",
            "product": {
              "name": "Microsoft Office 2019",
              "product_id": "T014534",
              "product_identification_helper": {
                "cpe": "cpe:/a:microsoft:office_2019:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Microsoft Office 2019 for Mac",
            "product": {
              "name": "Microsoft Office 2019 for Mac",
              "product_id": "T014533",
              "product_identification_helper": {
                "cpe": "cpe:/a:microsoft:office_2019_for_mac:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Microsoft Skype for Business Server 2015 CU13",
                "product": {
                  "name": "Microsoft Skype for Business Server 2015 CU13",
                  "product_id": "T030376",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:skype:for_business_server_2015_cu13"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Microsoft Skype for Business Server 2019 CU7",
                "product": {
                  "name": "Microsoft Skype for Business Server 2019 CU7",
                  "product_id": "T030377",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:skype:for_business_server_2019_cu7"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Skype"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-41763",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-41763"
    },
    {
      "cve": "CVE-2023-36789",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-36789"
    },
    {
      "cve": "CVE-2023-36786",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-36786"
    },
    {
      "cve": "CVE-2023-36780",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-36780"
    },
    {
      "cve": "CVE-2023-36569",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-36569"
    },
    {
      "cve": "CVE-2023-36568",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-36568"
    },
    {
      "cve": "CVE-2023-36565",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-36565"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2023-41763 (GCVE-0-2023-41763)

CISA KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

KEVintel KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: kevintel

Details

References

Solution

Solution

Tags

Sightings

Nomenclature