MSRC-CVE-2022-26910 — Skype for Business and Lync Spoofing Vulnerability

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An attacker could make a specially crafted network call to the target Skype for Business server, which could cause the parsing of an http request made to an arbitrary address. This could disclose IP addresses or port numbers or both to the attacker.

Security updates
9319.628 — https://support.microsoft.com/help/5012686

Vulnerabilities 1

Medium 5.3

CVE-2022-26910

Skype for Business and Lync Spoofing Vulnerability

Skype for Business and Lync Spoofing Vulnerability

Microsoft Skype for Business Server 2019 CU6 Skype for Business Server 2015 CU12

Apr 15, 2022

Revision history

2022-04-12 #1
Information published.

References

CVE-2022-26910 Skype for Business and Lync Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26910
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss