Medium severity · published Dec 10, 2019
CVE-2019-1490
A spoofing vulnerability exists when a Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business Server Spoofing Vulnerability'
5.4
CVSS
1.5%
EPSS
No
On KEV
Description
A spoofing vulnerability exists when a Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business Server Spoofing Vulnerability'.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Skype For Business · Microsoft
2019 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-1490
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-1490
Patch
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1490
More from Skype For Business
5.3
CVE-2023-41763
Skype for Business Elevation of Privilege Vulnerability
9.8
CVE-2020-1025
An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation
9.8
CVE-2016-7182
The Graphics component in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10…
8.8
CVE-2018-8311
A remote code execution vulnerability exists when Skype for Business and Microsoft Lync clients fail to properly sanitize specially crafted content, aka "Remote Code Execution…
8.8
CVE-2017-11786
Skype for Business in Microsoft Lync 2013 SP1 and Skype for Business 2016 allows an attacker to steal an authentication hash that can be reused elsewhere, due to how Skype for…