Summary
Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
A user would need to join a malicious Microsoft Teams meeting set up by the attacker.
According to the CVSS metric, the attack vector is network (AV:N) and privilege required is none (PR:N). What is the target used in the context of the remote code execution?
An attacker would be required to trick the victim into joining a Teams meeting which would enable them to perform remote code execution in the context of the victim user. The attacker does not need privileges to attempt to exploit this vulnerability.
According to the CVSS metric, successful exploitation of this vulnerability could lead to total loss of confidentiality (C:H), integrity (I:H), and availability (A:H). What does that mean for this vulnerability?
An attacker who successfully exploits this vulnerability could perform a remote attack that could enable access to the victim's information and the ability to alter information. Successful exploitation could also potentially cause downtime for the client machine.
Security updates
1.6.00.18681 — https://docs.microsoft.com/en-us/microsoftteams/teams-client-update
5.12.1 — https://apps.apple.com/us/app/microsoft-teams/id1113153706
1.0.0.2023070204 — https://play.google.com/store/apps/details?id=com.microsoft.teams
1.6.00.17554 — https://learn.microsoft.com/en-us/officeupdates/teams-app-versioning
Vulnerabilities 1
-
High 8.8
Microsoft Teams Remote Code Execution Vulnerability
Microsoft Teams Remote Code Execution Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2023-29328 Microsoft Teams Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29328
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss