CVE-2020-1025

Опубликовано: 14 июл. 2020

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Средний

Описание

An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation. An attacker who successfully exploited the vulnerability could bypass authentication and achieve improper access. To exploit this vulnerability, an attacker would need to modify the token. The update addresses the vulnerability by modifying how Microsoft SharePoint Server and Skype for Business Server validate tokens.

Ссылки

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1025
Patch
Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1025
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:microsoft:lync:2013:*:*:*:*:*:*:*

cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*

cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*

cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*

cpe:2.3:a:microsoft:skype_for_business:2015:cumulative_update_8:*:*:*:*:*:*

cpe:2.3:a:microsoft:skype_for_business:2019:cumulative_update_2:*:*:*:*:*:*

EPSS

Процентиль: 94%

0.13799

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2020-1025

msrc

больше 5 лет назад

Microsoft Office Elevation of Privilege Vulnerability

GHSA-5xrx-pfvm-p5p8

CVSS3: 9.8

github

больше 3 лет назад

An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation, aka 'Microsoft Office Elevation of Privilege Vulnerability'.

BDU:2020-03370

CVSS3: 7.8

fstec