Microsoft Office Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation. An attacker who successfully exploited the vulnerability could bypass authentication and achieve improper access.
To exploit this vulnerability, an attacker would need to modify the token.
The update addresses the vulnerability by modifying how Microsoft SharePoint Server and Skype for Business Server validate tokens.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Skype for Business Server 2019 CU2
Vendor
Microsoft
Product
Skype for Business Server 2019 CU2
Platforms
Unknown
Default status
Unknown
Skype for Business Server 2019 CU2 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
7.0.0
affected
custom
publication
Unavailable
None listed
Skype for Business Server 2015 CU 8
Vendor
Microsoft
Product
Skype for Business Server 2015 CU 8
Platforms
Unknown
Default status
Unknown
Skype for Business Server 2015 CU 8 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
2015 CU 8
affected
custom
publication
Unavailable
None listed
Microsoft Lync Server 2013
Vendor
Microsoft
Product
Microsoft Lync Server 2013
Platforms
Unknown
Default status
Unknown
Microsoft Lync Server 2013 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
publication
Unavailable
None listed
Microsoft SharePoint Enterprise Server 2016
Vendor
Microsoft
Product
Microsoft SharePoint Enterprise Server 2016
Platforms
x64-based Systems
Default status
Unknown
Microsoft SharePoint Enterprise Server 2016 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
16.0.0
affected
custom
publication
Unavailable
None listed
Microsoft SharePoint Server 2019
Vendor
Microsoft
Product
Microsoft SharePoint Server 2019
Platforms
x64-based Systems
Default status
Unknown
Microsoft SharePoint Server 2019 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
16.0.0
affected
custom
publication
Unavailable
None listed
Microsoft SharePoint Foundation 2013 Service Pack 1
Vendor
Microsoft
Product
Microsoft SharePoint Foundation 2013 Service Pack 1
Platforms
x64-based Systems
Default status
Unknown
Microsoft SharePoint Foundation 2013 Service Pack 1 · Scoped product and version facts