Microsoft Teams’ link preview feature contains four vulnerabilities that allow attackers to access internal Microsoft services. One vulnerability allows attackers to spoof the preview and leak their IP address and use denial-of-service attacks against their Teams app/channels. Only one of the four vulnerabilities has been patched and the rest remain open. Microsoft says the vulnerabilities do not pose “immediate threats requiring a security fix” The vulnerabilities were discovered by Fabian Brunlein, a security consultant at Positive Security, who says he’s not aware of any active exploitation.”]
Source: https://www.cuinfosecurity.com/4-bugs-found-in-microsoft-teams-link-preview-feature-a-18191