CVEvulnerability
CVE-2017-11786
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-10-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-294
Description
Skype for Business in Microsoft Lync 2013 SP1 and Skype for Business 2016 allows an attacker to steal an authentication hash that can be reused elsewhere, due to how Skype for Business handles authentication requests, aka "Skype for Business Elevation of Privilege Vulnerability."
Affected configurations
• microsoft lync 2013
• microsoft skype for business 2016
Related
Weakness · CWE (1)
- CWE-294 Authentication Bypass by Capture-replay weakness
References
- http://www.securityfocus.com/bid/101156 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039530 Third Party Advisory, VDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11786 Patch, Vendor Advisory
- http://www.securityfocus.com/bid/101156 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039530 Third Party Advisory, VDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11786 Patch, Vendor Advisory