PT-2020-11954 · Microsoft · Teams

Oskars Vegeris · Published 2020-12-09 · Updated 2020-12-10 · CVE-2020-10146

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Teams (affected versions not specified)

Description The Microsoft Teams online service contains a stored cross-site scripting issue in the displayName parameter. This can be exploited on Teams clients to obtain sensitive information, such as authentication tokens, and possibly execute arbitrary commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-10146

Affected Products

Teams

References · 8

• 🔥 https://github.com/oskarsve/ms-teams-rce · Exploit
• https://osv.dev/vulnerability/CVE-2020-10146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10146 · Security Note
• https://t.me/cibsecurity/17548 · Telegram Post
• https://t.me/cibsecurity/17528 · Telegram Post
• https://t.me/cibsecurity/17468 · Telegram Post
• https://t.me/cibsecurity/17508 · Telegram Post
• https://t.me/cibsecurity/17488 · Telegram Post