CVE-2015-2420: XSS

Published Aug 15, 2015

Updated

Cross-site scripting (XSS) vulnerability in Microsoft System Center 2012 Operations Manager Gold before Rollup 8, SP1 before Rollup 10, and R2 before Rollup 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "System Center Operations Manager Web Console XSS Vulnerability."

Affected Software

22 affected components

Microsoft System Center Operations Manager=2012-r2_rollup1

Microsoft System Center Operations Manager=2012-r2_rollup2

Microsoft System Center Operations Manager=2012-r2_rollup3

Microsoft System Center Operations Manager=2012-r2_rollup4

Microsoft System Center Operations Manager=2012-r2_rollup5

Microsoft System Center Operations Manager=2012-r2_rollup6

Microsoft System Center Operations Manager=2012-rollup1

Microsoft System Center Operations Manager=2012-rollup2

Microsoft System Center Operations Manager=2012-rollup3

Microsoft System Center Operations Manager=2012-rollup4

Microsoft System Center Operations Manager=2012-rollup5

Microsoft System Center Operations Manager=2012-rollup6

Microsoft System Center Operations Manager=2012-rollup7

Microsoft System Center Operations Manager=2012-sp1_rollup1

Microsoft System Center Operations Manager=2012-sp1_rollup2

Microsoft System Center Operations Manager=2012-sp1_rollup3

Microsoft System Center Operations Manager=2012-sp1_rollup4

Microsoft System Center Operations Manager=2012-sp1_rollup5

Microsoft System Center Operations Manager=2012-sp1_rollup6

Microsoft System Center Operations Manager=2012-sp1_rollup7

Microsoft System Center Operations Manager=2012-sp1_rollup8

Microsoft System Center Operations Manager=2012-sp1_rollup9

Remediation

Patch Available

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-086

Event History

Aug 15, 2015

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-2420?

CVE-2015-2420 has a Common Vulnerability Scoring System (CVSS) score indicating a medium severity level.

How do I fix CVE-2015-2420?

To fix CVE-2015-2420, apply the latest rollup update for your version of Microsoft System Center 2012 Operations Manager.

What type of vulnerability is CVE-2015-2420?

CVE-2015-2420 is classified as a cross-site scripting (XSS) vulnerability.

What software versions are affected by CVE-2015-2420?

CVE-2015-2420 affects various versions of Microsoft System Center 2012 Operations Manager prior to specific rollups.

Can CVE-2015-2420 be exploited remotely?

Yes, CVE-2015-2420 can be exploited remotely by attackers through a crafted URL.