CVE-2015-2543: XSS

Published Sep 9, 2015

Updated

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."

Affected Software

2 affected components

Microsoft Exchange Server=2013-cumulative_update_8

Microsoft Exchange Server=2013-cumulative_update_9

Event History

Sep 9, 2015

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-2543?

CVE-2015-2543 has a medium severity rating due to its potential to allow cross-site scripting attacks.

How do I fix CVE-2015-2543?

To fix CVE-2015-2543, apply the appropriate cumulative update for Microsoft Exchange Server 2013, specifically Cumulative Update 10 or later.

What software versions are affected by CVE-2015-2543?

CVE-2015-2543 affects Microsoft Exchange Server 2013 Cumulative Update 8 and Cumulative Update 9.

Can CVE-2015-2543 be exploited remotely?

Yes, CVE-2015-2543 can be exploited remotely through crafted email messages.

What type of attack does CVE-2015-2543 facilitate?

CVE-2015-2543 facilitates cross-site scripting (XSS) attacks, allowing the injection of arbitrary web scripts.