CVE-2016-0030: XSS

Published Jan 13, 2016

Updated

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."

Affected Software

3 affected components

Microsoft Exchange Server=2013-cumulative_update_10

Microsoft Exchange Server=2013-sp1

Microsoft Exchange Server=2016

Remediation

Patch Available

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-010

Event History

Jan 13, 2016

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-0030?

CVE-2016-0030 has been assigned a high severity rating due to its potential for remote code execution via cross-site scripting.

How do I fix CVE-2016-0030?

To fix CVE-2016-0030, apply the relevant patches provided by Microsoft for Exchange Server versions affected.

What systems are affected by CVE-2016-0030?

CVE-2016-0030 affects Microsoft Exchange Server 2013 SP1, 2013 Cumulative Update 10, and 2016.

What type of vulnerability is CVE-2016-0030?

CVE-2016-0030 is a cross-site scripting (XSS) vulnerability that allows attackers to inject arbitrary web scripts.

Can CVE-2016-0030 be exploited remotely?

Yes, CVE-2016-0030 can be exploited remotely through crafted URLs that target the Outlook Web Access interface.