CVE-2015-2544: XSS

Published Sep 9, 2015

Updated

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."

Affected Software

3 affected components

Microsoft Exchange Server=2013-cumulative_update_8

Microsoft Exchange Server=2013-cumulative_update_9

Microsoft Exchange Server=2013-sp1

Event History

Sep 9, 2015

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-2544?

The severity of CVE-2015-2544 is classified as moderate, as it allows for cross-site scripting (XSS) attacks via crafted e-mail messages.

How do I fix CVE-2015-2544?

To fix CVE-2015-2544, it is recommended to apply the latest cumulative update or service pack for Microsoft Exchange Server 2013.

What software is affected by CVE-2015-2544?

CVE-2015-2544 affects Microsoft Exchange Server 2013 Cumulative Updates 8 and 9, as well as Service Pack 1.

Can CVE-2015-2544 be exploited remotely?

Yes, CVE-2015-2544 can be exploited remotely by sending a specially crafted e-mail message.

What type of attack does CVE-2015-2544 enable?

CVE-2015-2544 enables attackers to perform cross-site scripting (XSS) attacks, allowing them to inject arbitrary web scripts or HTML.