CVE-2020-10146

MEDIUM

Microsoft Teams < 2020-10-29 - Stored Cross-Site Scripting via DisplayName Parameter

Title source: llm

Description

The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter that can be exploited on Teams clients to obtain sensitive information such as authentication tokens and to possibly execute arbitrary commands. This vulnerability was fixed for all Teams users in the online service on or around October 2020.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://github.com/oskarsve/ms-teams-rce

Scores

CVSS v3 5.7

EPSS 0.0189

EPSS Percentile 77.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Details

CWE

CWE-79

Status published

Products (1)

microsoft/teams < 2020-10-29

Published Dec 09, 2020

Tracked Since Feb 18, 2026