CVE-2023-41763mediumunder attackCWE-918

CVE-2023-41763: medium-severity vulnerability in Microsoft Skype for Business Server 2015 CU13

Skype for Business Elevation of Privilege Vulnerability

Published · Updated

Follow this CVE+ Monitor Skype for Business Server+ Monitor Skype

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

80Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 5.3epss 90%
from disclosure to weapon
Published on NVDOct 10
CISA KEVOct 10
Action required by CISAfederal deadline: 2023-10-31

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Skype for Business has a vulnerability that allows an attacker to gain higher permissions on a system by exploiting improper privilege handling. This is dangerous because it could let someone access features or data they shouldn't be able to.

Technical detail

This elevation of privilege vulnerability (CWE-918) in Skype for Business arises from improper authorization checks, potentially allowing an authenticated local attacker to escalate privileges. The attack requires prior system access and successful exploitation results in unauthorized access to restricted functionality or system resources.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Skype for Business Elevation of Privilege Vulnerability
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
Affected products
Microsoft · Skype for Business Server 2015 CU13Microsoft · Skype for Business Server 2019 CU7
Related CVEs — Microsoft Skype for Business Server 2015 CU13

In the same product, most dangerous first.

CVE-2023-36780HIGHSkype for Business Remote Code Execution VulnerabilityEPSS 2.7%CVE-2023-36786HIGHSkype for Business Remote Code Execution VulnerabilityEPSS 2.6%CVE-2023-36789HIGHSkype for Business Remote Code Execution VulnerabilityEPSS 2.5%CVE-2026-66307HIGHSkype for Business and Lync Denial of Service VulnerabilityEPSS 1.2%CVE-2026-70297HIGHSkype for Business Remote Code Execution VulnerabilityEPSS 1.2%CVE-2026-83746HIGHSkype for Business Elevation of Privilege VulnerabilityEPSS 1.1%