Comment by bouke

> Microsoft accepted this chain of bugs as "Important" (severity), "Spoofing" (impact) in O365 cloud bug bounty program. That is one of the lowest in-scope ratings possible.

This is beyond believe: a RCE classified as "Spoofing".