Skip to content
fr Sign in
Not rated

CVE-2020-1025 An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly…

Description

An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation. An attacker who successfully exploited the vulnerability could bypass authentication and achieve improper access. To exploit this vulnerability, an attacker would need to modify the token. The update addresses the vulnerability by modifying how Microsoft SharePoint Server and Skype for Business Server validate tokens.

Affected products and versions

Product Affected versions Fixed in
Skype for Business Server 2019 CU2 7.0 7.0.0 → latest No fix stated
Skype for Business Server 2015 CU 8 Versions not published
Microsoft Lync Server 2013 Versions not published
Microsoft SharePoint Enterprise Server 2016 16.0 16.0.0 → latest No fix stated
Microsoft SharePoint Server 2019 16.0 16.0.0 → latest No fix stated
Microsoft SharePoint Foundation 2013 Service Pack 1 15.0 15.0.0 → latest No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Skype for Business Server 2019 CU2

The 3 CVEs of Skype for Business Server 2019 CU2 →
CVE-2021-24099 Skype for Business and Lync Denial of Service Vulnerability 6.5 Medium CVE-2019-1490 A spoofing vulnerability exists when a Skype for Business Server does not properly sanitize a specially crafted request,… Not rated
Track this CVE