A vulnerability was found in Microsoft Skype for Business Server 2015 CU13/2019 CU7 (Unified Communication Software). It has been rated as problematic. This issue affects an unknown functionality. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality.

The weakness was published 10/10/2023 as confirmed security guidance (Website). The advisory is shared at portal.msrc.microsoft.com. The identification of this vulnerability is CVE-2023-41763. Technical details are unknown but an exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/29/2024). MITRE ATT&CK project uses the attack technique T1592 for this issue.

It is declared as highly functional. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 10/10/2023 with a due date of 10/31/2023:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Productinfo

Type

• Unified Communication Software

Vendor

• Microsoft

Name

• Skype for Business Server

Version

• 2015 CU13
• 2019 CU7

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion