CVE-2015-1633: XSS
First published: Wed Mar 11 2015(Updated: )
Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, SharePoint Foundation 2013 Gold and SP1, and SharePoint Server 2013 Gold and SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft SharePoint Foundation 2013 | =2010-sp2 | |
| Microsoft SharePoint Foundation 2013 | =2013 | |
| Microsoft SharePoint Foundation 2013 | =2013-sp1 | |
| Microsoft SharePoint Server 2010 | =2010-sp2 | |
| Microsoft SharePoint Server 2010 | =2013 | |
| Microsoft SharePoint Server 2010 | =2013-sp1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2015-1633?
CVE-2015-1633 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2015-1633?
To mitigate CVE-2015-1633, it is recommended to apply the latest security updates provided by Microsoft for affected SharePoint products.
Who is affected by CVE-2015-1633?
CVE-2015-1633 affects remote authenticated users of Microsoft SharePoint Foundation and SharePoint Server versions specified in the vulnerability description.
What type of vulnerability is CVE-2015-1633?
CVE-2015-1633 is a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious web scripts or HTML.
What versions of SharePoint are vulnerable to CVE-2015-1633?
The vulnerable versions include Microsoft SharePoint Foundation 2010 SP2, 2013 (Gold and SP1) and Microsoft SharePoint Server 2010 SP2, 2013 (Gold and SP1).
- agent/type
- agent/references
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- vendor/microsoft
- canonical/microsoft sharepoint foundation 2013
- version/microsoft sharepoint foundation 2013/2010-sp2
- version/microsoft sharepoint foundation 2013/2013
- version/microsoft sharepoint foundation 2013/2013-sp1
- canonical/microsoft sharepoint server 2010
- version/microsoft sharepoint server 2010/2010-sp2
- version/microsoft sharepoint server 2010/2013
- version/microsoft sharepoint server 2010/2013-sp1