Multiple vulnerabilities in Microsoft Teams
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2023-29330 CVE-2023-29328 |
| CWE-ID | CWE-20 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Microsoft Teams for iOS Mobile applications / Apps for mobile phones Microsoft Teams for Mac Mobile applications / Apps for mobile phones Microsoft Teams for Desktop Mobile applications / Apps for mobile phones Microsoft Teams for Android Mobile applications / Apps for mobile phones |
| Vendor | Microsoft |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Input validation error
EUVDB-ID: #VU79186
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-29330
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insufficient validation of user-supplied input in Microsoft Teams. A remote attacker can trick a victim to join a malicious Microsoft Teams meeting and execute arbitrary code on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMicrosoft Teams for iOS: All versions
Microsoft Teams for Mac: All versions
Microsoft Teams for Desktop: All versions
Microsoft Teams for Android: All versions
CPE2.3- cpe:2.3:a:microsoft:microsoft_teams_for_ios:*:*:*:*:*:*:*:
- cpe:2.3:a:microsoft:microsoft_teams_for_mac:*:*:*:*:*:*:*:
- cpe:2.3:a:microsoft:microsoft_teams_for_desktop:*:*:*:*:*:*:*:
- cpe:2.3:a:microsoft:microsoft_teams_for_android:*:*:*:*:*:*:*:
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-29330
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to perform certain actions on the device.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Input validation error
EUVDB-ID: #VU79191
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-29328
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insufficient validation of user-supplied input in Microsoft Teams. A remote attacker can trick a victim to join a malicious Microsoft Teams meeting and execute arbitrary code on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMicrosoft Teams for iOS: All versions
Microsoft Teams for Mac: All versions
Microsoft Teams for Android: All versions
Microsoft Teams for Desktop: All versions
CPE2.3- cpe:2.3:a:microsoft:microsoft_teams_for_ios:*:*:*:*:*:*:*:
- cpe:2.3:a:microsoft:microsoft_teams_for_mac:*:*:*:*:*:*:*:
- cpe:2.3:a:microsoft:microsoft_teams_for_android:*:*:*:*:*:*:*:
- cpe:2.3:a:microsoft:microsoft_teams_for_desktop:*:*:*:*:*:*:*:
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-29328
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to perform certain actions on the device.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
