Information disclosure in Skype for Business Server - CVE-2023-41763
Published: October 10, 2023
Vulnerability identifier: #VU81729
CSH Severity: High
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-41763
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote attacker can gain unauthorized access to IP addresses or port numbers or both to the attacker.
Note, the vulnerability is being actively exploited in the wild.
Affected software
Skype for Business Server
How to mitigate CVE-2023-41763
Install updates from vendor's website.
Skype for Business Server - addressed in versions 6.0.9319.869, 7.0.246.530