CVE-2022-33633 Skype for Business and Lync Remote Code Execution Vulnerability
Attackers can execute arbitrary code on Microsoft Skype for Business and Lync servers, requiring immediate patching by administrators.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-33633?
CVE-2022-33633 is a high-severity code injection vulnerability in Microsoft Lync Server 2013 CU10, published on 12 Jul 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Skype for Business and Lync Remote Code Execution Vulnerability
Which versions are affected by CVE-2022-33633?
It affects 2 products.
Products include Microsoft Lync Server, Microsoft Skype for Business.
How do I fix CVE-2022-33633?
No fix has been published for CVE-2022-33633 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-33633 being exploited?
There is no known exploitation of CVE-2022-33633 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Lync Server 2013 CU10
- CVE-2021-26422 Skype for Business and Lync Remote Code Execution Vulnerability
- CVE-2022-26911 Skype for Business Information Disclosure Vulnerability
- CVE-2021-26421 Skype for Business and Lync Spoofing Vulnerability
- CVE-2021-24073 Skype for Business and Lync Spoofing Vulnerability
- CVE-2021-24099 Skype for Business and Lync Denial of Service Vulnerability
Sources
Also known as GHSA-m4g8-6pfp-59jr.