CVE-2015-1630: XSS

Published Mar 11, 2015

Updated

Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Audit Report Cross Site Scripting Vulnerability."

Affected Software

2 affected components

Microsoft Exchange Server=2013-cumulative_update_7

Microsoft Exchange Server=2013-sp1

Event History

Mar 11, 2015

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-1630?

CVE-2015-1630 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2015-1630?

To mitigate CVE-2015-1630, apply the latest patches provided by Microsoft for Exchange Server 2013 SP1 and Cumulative Update 7.

What kind of attacks can CVE-2015-1630 allow?

CVE-2015-1630 allows remote attackers to inject arbitrary web scripts or HTML into the Outlook Web App.

Which versions of Microsoft Exchange Server are affected by CVE-2015-1630?

CVE-2015-1630 affects Microsoft Exchange Server 2013 SP1 and Cumulative Update 7.

Is user interaction required for exploitation of CVE-2015-1630?

Yes, exploitation of CVE-2015-1630 typically requires user interaction, such as clicking on a crafted URL.