CVE-2020-10146: Microsoft Teams displayName stored cross-site scripting vulnerability

Q: What is CVE-2020-10146?

CVE-2020-10146 is a stored cross-site scripting vulnerability in the displayName parameter of the Microsoft Teams online service.

Q: How severe is CVE-2020-10146?

CVE-2020-10146 has a Medium severity with a CVSS score of 5.4.

Q: How can CVE-2020-10146 be exploited?

CVE-2020-10146 can be exploited on Teams clients to obtain sensitive information and possibly execute arbitrary commands.

Q: Has CVE-2020-10146 been fixed?

Yes, this vulnerability has been fixed for all Teams clients up to October 29, 2020.

Q: How can I protect myself from CVE-2020-10146?

To protect yourself from CVE-2020-10146, make sure you are using the latest version of Microsoft Teams.

Published Dec 9, 2020

Updated

The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter that can be exploited on Teams clients to obtain sensitive information such as authentication tokens and to possibly execute arbitrary commands. This vulnerability was fixed for all Teams users in the online service on or around October 2020.

Affected Software

1 affected component

Microsoft Teams<2020-10-29

Remediation

Information

This vulnerability was fixed for all Teams users in the online service on or around October 2020.

Event History

Dec 9, 2020

CVE Published

via MITRE·12:30 AM

Data Sourced

via MITRE·12:30 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2020-10146?

CVE-2020-10146 is a stored cross-site scripting vulnerability in the displayName parameter of the Microsoft Teams online service.

How severe is CVE-2020-10146?

CVE-2020-10146 has a Medium severity with a CVSS score of 5.4.

How can CVE-2020-10146 be exploited?