CVE-2018-8238
published 2018-07-11CVE-2018-8238: A security feature bypass vulnerability exists when Skype for Business or Lync do not properly parse UNC path links shared via messages, aka "Skype for…
PriorityP340high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EPSS
5.99%
93.3th percentile
A security feature bypass vulnerability exists when Skype for Business or Lync do not properly parse UNC path links shared via messages, aka "Skype for Business and Lync Security Feature Bypass Vulnerability." This affects Skype, Microsoft Lync.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | lync | — | — |
| microsoft | microsoft_lync | — | — |
| microsoft | microsoft_lync | — | — |
| microsoft | skype | — | — |
| microsoft | skype | — | — |
| microsoft | skype_for_business | — | — |
| msrc | microsoft_lync_2013_service_pack_1 | — | — |
| msrc | skype_for_business_2016 | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_msrc7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v74r-x7x3-53vj: A security feature bypass vulnerability exists when Skype for Business or Lync do not properly parse UNC path links shared via messages, aka "Skype fo
ghsa_unreviewed·2022-05-13
CVE-2018-8238 [HIGH] GHSA-v74r-x7x3-53vj: A security feature bypass vulnerability exists when Skype for Business or Lync do not properly parse UNC path links shared via messages, aka "Skype fo
A security feature bypass vulnerability exists when Skype for Business or Lync do not properly parse UNC path links shared via messages, aka "Skype for Business and Lync Security Feature Bypass Vulnerability." This affects Skype, Microsoft Lync.
Microsoft
Skype for Business and Lync Security Feature Bypass Vulnerability
vendor_msrc·2018-07-10·CVSS 7.8
CVE-2018-8238 [HIGH] Skype for Business and Lync Security Feature Bypass Vulnerability
Skype for Business and Lync Security Feature Bypass Vulnerability
Description: A security feature bypass vulnerability exists when Skype for Business or Lync do not properly parse UNC path links shared via messages. An attacker who successfully exploited the vulnerability could execute arbitrary commands in the context of the logged-in user. The security feature bypass by itself does not allow arbitrary code execution. Instead, an attacker would have to convince users to click a link to a file.
In a file-sharing attack scenario, an attacker could provide a specially-crafted file designed to exploit the vulnerability, and then convince a user to click the link to the file.
The update addresses the vulnerability by correcting how Skype for Business and Lync handle links to UNC paths.
Skype
No detection rules found.
No public exploits indexed.
Talos
Microsoft Patch Tuesday - July 2018
blogs_talos·2018-07-10·CVSS 7.5
[HIGH] Microsoft Patch Tuesday - July 2018
Microsoft released its monthly set of security advisories today for vulnerabilities that have been identified and addressed in various products. This month's release addresses 53 new vulnerabilities, 17 of which are rated critical, 34 are rated important, one is rated moderate, and one is rated as low severity. These vulnerabilities impact Windows Operating System, Edge, Internet Explorer and more.
In addition to the 53 vulnerabilities referenced above, Microsoft has also released a critical update advisory, ADV180017, which addresses the vulnerabilities described in the Adobe security bulletin APSB18-24.
## Critical vulnerabilitiesThis month, Microsoft is addressing 17 vulnerabilities that are rated as critical:
CVE-2018-8242 - Scripting Engine Memory Corruption Vulnerability
CVE-2018-
Talos
Microsoft Patch Tuesday - July 2018
blogs_talos·2018-07-10·CVSS 7.5
[HIGH] Microsoft Patch Tuesday - July 2018
## Microsoft Patch Tuesday - July 2018
Microsoft released its monthly set of security advisories today for vulnerabilities that have been identified and addressed in various products. This month's release addresses 53 new vulnerabilities, 17 of which are rated critical, 34 are rated important, one is rated moderate, and one is rated as low severity. These vulnerabilities impact Windows Operating System, Edge, Internet Explorer and more.
In addition to the 53 vulnerabilities referenced above, Microsoft has also released a critical update advisory, ADV180017 , which addresses the vulnerabilities described in the Adobe security bulletin APSB18-24 .
## Critical vulnerabilities This month, Microsoft is addressing 17 vulnerabilities that are rated as critical:
CVE-2018-8242 - Scripting Engin
2018-07-11
Published