Read the docs
TI-2019-00412 Aliases CVE-2019-0622GHSA-65j8-j9v8-cm3q

Improper authentication in Microsoft Skype

Priority LOW 25CWE-287Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

An elevation of privilege vulnerability exists when Skype for Andriod fails to properly handle specific authentication requests, aka "Skype for Android Elevation of Privilege Vulnerability." This affects Skype 8.35.

Why it matters now

EPSS 0.01968 80th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftSkype8.35 when installed on Android Devices—No fix listedCNA
  • Skype VendorMicrosoft Affected 8.35 when installed on Android Devices Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:skype:8.35:*:*:*:*:android:*:*8.35VulnerableMicrosoft
  • cpe:2.3:a:microsoft:skype:8.35:*:*:*:*:android:*:* Versions 8.35 Vulnerable ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-0622
  2. 2026-10-03 Alias added: GHSA-65j8-j9v8-cm3q

References

Advisory 1

  • TI-2017-04301 Microsoft Skype 7.16.0.102 contains a vulnerability that could allow an unauthenticated… CVSS 3.0CRITICAL 9.8
  • TI-2017-07315 A stack buffer overflow vulnerability has been discovered in Microsoft Skype 7.2, 7.35… CVSS 3.0HIGH 8.8
  • TI-2018-00552 Untrusted search path in Microsoft The installer of Skype for Windows CVSS 3.0HIGH 7.8
  • TI-2018-00551 Untrusted search path in Microsoft Skype for Windows CVSS 3.0HIGH 7.8
  • TI-2016-04964 Multiple untrusted search path vulnerabilities in Microsoft Skype allow local users to… CVSS 3.0HIGH 7.8
  • TI-2019-00681 An information disclosure vulnerability exists in Skype for Android, aka 'Skype for… CVSS 3.0MEDIUM 5.9
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences