VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Jul 14, 2020· Updated Jun 17, 2026

CVE-2020-1025

CVE-2020-1025

Description

An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation. An attacker who successfully exploited the vulnerability could bypass authentication and achieve improper access. To exploit this vulnerability, an attacker would need to modify the token. The update addresses the vulnerability by modifying how Microsoft SharePoint Server and Skype for Business Server validate tokens.

Affected products

10
  • Microsoft/Lync
    cpe:2.3:a:microsoft:lync:2013:*:*:*:*:*:*:*
  • Microsoft/Lync Serverv5
    cpe:2.3:a:microsoft:lync_server:2013:*:*:*:*:*:*:*
    Range: 0
  • Microsoft/Sharepoint Server4 versions
    cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*range: 16.0.0
    • cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*
    • (no CPE)
  • Microsoft/Sharepoint Foundation
    cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*
  • Microsoft/Skype For Business3 versions
    cpe:2.3:a:microsoft:skype_for_business:2015:cumulative_update_8:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:microsoft:skype_for_business:2015:cumulative_update_8:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:skype_for_business:2019:cumulative_update_2:*:*:*:*:*:*
    • (no CPE)

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.