Skip to content
OpenAdvisories
High MSRC-CVE-2023-24881 1 CVE

Microsoft Teams Information Disclosure Vulnerability

Published May 9, 2023 · Updated Jul 21, 2023 · Revision 2

Summary

Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What type of information could be disclosed by this vulnerability?
This vulnerability could disclose sensitive information, which might include a user's full trust token.

How could an attacker exploit the vulnerability?
In a network-based attack, an attacker could host a site containing malicious code. When a target accesses that site, it could force open a full trust application and potentially obtain a user's full trust token.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
Exploitation of the vulnerability requires that a user navigate to a malicious site hosted on *.sharepoint.com.

Security updates
2.10.1 — https://docs.microsoft.com/en-us/microsoftteams/teams-client-update

Vulnerabilities 1

Revision history

  1. #2

    Removed one of the FAQs. This is an information change only.

  2. #1

    Information published.

References