CVE-2015-2359: XSS

Published Jun 10, 2015

Updated

Cross-site scripting (XSS) vulnerability in the web applications in Microsoft Exchange Server 2013 Cumulative Update 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Exchange HTML Injection Vulnerability."

Affected Software

2 affected components

Microsoft Exchange Server=2013-cumulative_update_8

Microsoft Exchange Server=2013-sp1

Event History

Jun 10, 2015

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-2359?

CVE-2015-2359 is rated as important due to its potential for remote code execution via cross-site scripting.

How do I fix CVE-2015-2359?

To fix CVE-2015-2359, apply the latest security update provided by Microsoft for Exchange Server 2013.

What versions of Exchange Server are affected by CVE-2015-2359?

CVE-2015-2359 affects Microsoft Exchange Server 2013 Cumulative Update 8 and Microsoft Exchange Server 2013 SP1.

What type of vulnerability is CVE-2015-2359?

CVE-2015-2359 is a cross-site scripting (XSS) vulnerability that allows attackers to inject arbitrary web scripts or HTML.

Can CVE-2015-2359 compromise my Exchange Server?

Yes, if exploited, CVE-2015-2359 can allow remote attackers to execute scripts in the context of an affected user's session.