ZDI-CAN-20751: ZDI-23-1541: (Pwn2Own) Microsoft Teams Incorrect Privilege Assignment Local Privilege Escalation Vulnerability

Published Oct 11, 2023

Updated

This vulnerability allows remote attackers to escalate privileges on affected installations of Microsoft Teams. An attacker must first obtain the ability to execute script within the application window in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5.

Affected Software

1 affected component

Microsoft Teams

Event History

Oct 11, 2023

Advisory Published

05:00 AM

Data Sourced

05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-20751?

The severity of ZDI-CAN-20751 is rated at 7.5 on the CVSS scale, indicating a high risk.

How do I fix ZDI-CAN-20751?

To mitigate ZDI-CAN-20751, ensure that Microsoft Teams is updated to the latest version released by Microsoft.

Who is affected by ZDI-CAN-20751?

ZDI-CAN-20751 affects installations of Microsoft Teams where script execution within the application window is possible.

What type of attack does ZDI-CAN-20751 facilitate?

ZDI-CAN-20751 allows remote attackers to escalate privileges after obtaining script execution capability within Microsoft Teams.

Is user interaction required to exploit ZDI-CAN-20751?

Yes, an attacker must first gain the ability to execute scripts in the application window to exploit ZDI-CAN-20751.