{
  "cveId": "CVE-2018-8238",
  "url": "https://patchblox.com/security/cve/CVE-2018-8238",
  "summary": "CVE-2018-8238 is fixed in 4 products on 1 platform, first by KB4022225, released July 10, 2018. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Skype for Business and Lync Security Feature Bypass Vulnerability",
  "description": "\u003Cp\u003EA security feature bypass vulnerability exists when Skype for Business or Lync do not properly parse UNC path links shared via messages. An attacker who successfully exploited the vulnerability could execute arbitrary commands in the context of the logged-in user. The security feature bypass by itself does not allow arbitrary code execution. Instead, an attacker would have to convince users to click a link to a file.\u003C/p\u003E\n\u003Cp\u003EIn a file-sharing attack scenario, an attacker could provide a specially-crafted file designed to exploit the vulnerability, and then convince a user to click the link to the file.\u003C/p\u003E\n\u003Cp\u003EThe update addresses the vulnerability by correcting how Skype for Business and Lync handle links to UNC paths.\u003C/p\u003E",
  "published": "2018-07-10T07:00:00Z",
  "severity": "Important",
  "epss": 0.05988,
  "epssPercentile": 0.93355,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "exploitabilityAssessment": "Exploitation Less Likely",
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2018-8238",
  "fixes": [
    {
      "platform": "microsoft",
      "product": "Microsoft Lync 2013 Service Pack 1 (32-bit)",
      "fixedVersion": "",
      "fix": "KB4022225",
      "url": "https://patchblox.com/security/fix/microsoft/kb4022225",
      "released": "2018-07-10T07:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Lync 2013 Service Pack 1 (64-bit)",
      "fixedVersion": "",
      "fix": "KB4022225",
      "url": "https://patchblox.com/security/fix/microsoft/kb4022225",
      "released": "2018-07-10T07:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Skype for Business 2016 (32-bit)",
      "fixedVersion": "",
      "fix": "KB4022221",
      "url": "https://patchblox.com/security/fix/microsoft/kb4022221",
      "released": "2018-07-10T07:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Skype for Business 2016 (64-bit)",
      "fixedVersion": "",
      "fix": "KB4022221",
      "url": "https://patchblox.com/security/fix/microsoft/kb4022221",
      "released": "2018-07-10T07:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}