CVE-2015-1628: XSS
Published Mar 11, 2015
·Updated
Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted X-OWA-Canary cookie in an AD.RecipientType.User action, aka "OWA Modified Canary Parameter Cross Site Scripting Vulnerability."
Affected Software
2 affected components
Microsoft Exchange Server=2013-cumulative_update_7
Microsoft Exchange Server=2013-sp1
Event History
Mar 11, 2015
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-1628?
CVE-2015-1628 is classified as a moderate severity vulnerability.
2
How do I fix CVE-2015-1628?
To fix CVE-2015-1628, apply the relevant security updates provided by Microsoft for Exchange Server 2013.
3
Which versions of Microsoft Exchange Server are affected by CVE-2015-1628?
CVE-2015-1628 affects Microsoft Exchange Server 2013 SP1 and Cumulative Update 7.
4
What type of vulnerability is CVE-2015-1628?
CVE-2015-1628 is a cross-site scripting (XSS) vulnerability.
5
What is the exploitation vector for CVE-2015-1628?
CVE-2015-1628 can be exploited through a crafted X-OWA-Canary cookie in an AD.RecipientType.User action.