Skype for Business Remote Code Execution Vulnerability

Source data

Overview

External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.

Impact & technical details

Remote Code Execution

How could an attacker exploit this vulnerability? An unauthenticated attacker could exploit this vulnerability over the network by sending a specially crafted request that writes an attacker-controlled file to an arbitrary location on the affected server. Successful exploitation could result in the attacker executing code on the target server. No authentication or user interaction is required.

CVSS base score

9.8 / 10

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Highest base score supplied by MSRC for this record; the vector belongs to that score. Ratings can vary by product. Microsoft Important is displayed as High; Moderate is displayed as Medium.

Affected products

• Skype for Business Server 2015 CU13
• Skype for Business Server 2019 CU8
• Skype for Business Server Subscription Edition CU1

Source guidance

Remediation

The source provides update references without a separate remediation summary. Review the applicable update links below.

At least one Microsoft vendor-fix reference is available. Check each affected product for its applicable update, prerequisites, and supported version.

Authoritative sources & updates

Findings and update information come from the linked publishers. GTP compiles the public record and provides the recommendation above. CVSS ratings shown here come from Microsoft. NVD references provide additional public context.

• Microsoft Security Response Center (opens in a new tab)
• Microsoft remediation guidance (opens in a new tab)
• Microsoft security update · 5123287 (opens in a new tab)
• Microsoft remediation guidance (opens in a new tab)
• Microsoft remediation guidance (opens in a new tab)