ZDI-CAN-20720: ZDI-23-1540: (Pwn2Own) Microsoft Teams Cross-Site Scripting Remote Code Execution Vulnerability
Published Oct 11, 2023
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Teams. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 5.0.
Affected Software
1 affected component
Microsoft Teams
Event History
Oct 11, 2023
Advisory Published
05:00 AM
Data Sourced
05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-20720?
The severity of ZDI-CAN-20720 is classified as high due to its potential for remote code execution.
2
How do I fix ZDI-CAN-20720?
To fix ZDI-CAN-20720, update Microsoft Teams to the latest version as recommended by Microsoft.
3
What type of attack is associated with ZDI-CAN-20720?
ZDI-CAN-20720 is associated with remote code execution attacks that require user interaction.
4
What must a user do to be exploited by ZDI-CAN-20720?
To be exploited by ZDI-CAN-20720, a user must visit a malicious page or open a malicious file.
5
Which software is affected by ZDI-CAN-20720?
Microsoft Teams is the affected software for vulnerability ZDI-CAN-20720.