| CVE ID | |
| CVSS SCORE | 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| AFFECTED VENDORS |
Microsoft |
| AFFECTED PRODUCTS |
Teams |
| VULNERABILITY DETAILS |
This vulnerability allows remote attackers to escape the sandbox on affected installations of Microsoft Teams. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the pluginHost component. The component exposes a WebView that allows an attacker to invoke arbitrary RPC calls. An attacker can leverage this vulnerability to escape the sandbox and execute arbitrary code in the context of the current process. |
| ADDITIONAL DETAILS |
Fixed on August 31, 2022 https://msrc.microsoft.com/update-guide/acknowledgement/online |
| DISCLOSURE TIMELINE |
|
| CREDIT | Masato Kinugawa |
