CVE-2020-10146

Microsoft Teams displayName stored cross-site scripting vulnerability

CVSS 5.7 MEDIUMEPSS 1.9%CWE-79

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.7EPSS 1.9%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

09 dez 2020Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter that can be exploited on Teams clients to obtain sensitive information such as authentication tokens and to possibly execute arbitrary commands. This vulnerability was fixed for all Teams users in the online service on or around October 2020.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Produtos afetados

Microsoft · Teams

Referências

https://github.com/oskarsve/ms-teams-rce