CVE-2018-8238

4 documents4 sources
Severity
7.8HIGH
EPSS
7.7%
top 8.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Microsoft Microsoft LyncMicrosoft SkypeMicrosoft Lync+1 more
Timeline
PublishedJul 11
Latest updateMay 13

Description

A security feature bypass vulnerability exists when Skype for Business or Lync do not properly parse UNC path links shared via messages, aka "Skype for Business and Lync Security Feature Bypass Vulnerability." This affects Skype, Microsoft Lync.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶NVDmicrosoft/lync2013
▶CVEListV5microsoft/skypeBusiness 2016 (32-bit), Business 2016 (64-bit)+1
▶NVDmicrosoft/skype2016
▶CVEListV5microsoft/microsoft_lync2013 Service Pack 1 (32-bit), 2013 Service Pack 1 (64-bit)+1

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-v74r-x7x3-53vj: A security feature bypass vulnerability exists when Skype for Business or Lync do not properly parse UNC path links shared via messages, aka "Skype fo↗2022-05-13
▶
CVEList
CVE-2018-8238: A security feature bypass vulnerability exists when Skype for Business or Lync do not properly parse UNC path links shared via messages, aka "Skype fo↗2018-07-11
▶

📋Vendor Advisories

1
Microsoft
Skype for Business and Lync Security Feature Bypass Vulnerability↗2018-07-10
▶
CVE-2018-8238 (HIGH CVSS 7.8) | A security feature bypass vulnerabi | cvebase.io