CVE-2023-41763

Deeper analysis

CVE-2023-41763 is an elevation-of-privilege vulnerability in Skype for Business that stems from a server-side request forgery flaw (CWE-918). The affected component allows an unauthenticated network attacker to cause the server to issue requests to arbitrary destinations, resulting in limited information disclosure as reflected in its CVSS 5.3 score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

An attacker with no credentials or user interaction can send crafted requests over the network to a Skype for Business server and obtain partial confidential data that would otherwise be inaccessible. Because the vulnerability requires no authentication and has a low attack complexity, it can be exploited from anywhere on the network reachable by the service.

Microsoft’s security update guide and the CISA Known Exploited Vulnerabilities catalog both reference the issue, indicating that administrators should apply the patches supplied through the standard Microsoft Update channels to eliminate the SSRF vector.

The EPSS score for this CVE rose sharply from a low baseline after disclosure, reaching a peak of 0.7335 on 2024-11-11 before receding to its current value of 0.1650; its inclusion in the CISA KEV catalog further confirms observed in-the-wild exploitation activity.