CVE-2020-1025
Microsoft Office Elevation of Privilege Vulnerability
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation. An attacker who successfully exploited the vulnerability could bypass authentication and achieve improper access. To exploit this vulnerability, an attacker would need to modify the token. The update addresses the vulnerability by modifying how Microsoft SharePoint Server and Skype for Business Server validate tokens.
Timeline
- CVE published
- Record last updated
Affected versions
- Microsoft Skype for Business Server 2019 CU2
From 7.0.0
- Microsoft Skype for Business Server 2015 CU 8
From 2015 CU 8
- Microsoft Microsoft Lync Server 2013
All versions
- Microsoft Microsoft SharePoint Enterprise Server 2016
From 16.0.0
- Microsoft Microsoft SharePoint Server 2019
From 16.0.0
- Microsoft Microsoft SharePoint Foundation 2013 Service Pack 1
From 15.0.0