CVE-2023-29330: Microsoft Teams Remote Code Execution Vulnerability

Overview

Severity
High (CVSS 8.8)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Category
Remote Code Execution
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2023-Aug
Released
2023-08-08
EPSS Score
0.60% (percentile: 69.4%)

FAQ

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? A user would need to join a malicious Microsoft Teams meeting set up by the attacker. According to the CVSS metric, the attack vector is network (AV:N) and privilege required is none (PR:N). What is the target used in the context of the remote code execution? An attacker would be required to trick the victim into joining a Teams meeting which would enable them to perform remote code execution in the context of the victim user. The attacker does not need privileges to attempt to exploit this vulnerability. According to the CVSS metric, successful exploitation of this vulnerability could lead to total loss of confidentiality (C:H), integrity (I:H), and availability (A:H). What does that mean for this vulnerability? An attacker who successfully exploits this vulnerability could perform a remote attack that could enable access to the victim's information and the ability to alter information. Successful exploitation could also potentially cause downtime for the client machine.

Affected Products (4)

Microsoft Office

  • Microsoft Teams for Desktop
  • Microsoft Teams for Android
  • Microsoft Teams for Mac
  • Microsoft Teams for iOS

Security Updates (4)

Acknowledgments

nicolas joly

Revision History

  • 2023-08-08: Information published.