CVE-2016-0032: XSS

Published Jan 13, 2016

Updated

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."

Affected Software

4 affected components

Microsoft Exchange Server=2013-cumulative_update_10

Microsoft Exchange Server=2013-cumulative_update_11

Microsoft Exchange Server=2013-sp1

Microsoft Exchange Server=2016

Remediation

Patch Available

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-010

Event History

Jan 13, 2016

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-0032?

CVE-2016-0032 has a critical severity rating due to its potential for exploitation via cross-site scripting.

How do I fix CVE-2016-0032?

To fix CVE-2016-0032, apply the latest security updates released by Microsoft for affected Exchange Server versions.

What versions are affected by CVE-2016-0032?

CVE-2016-0032 affects Microsoft Exchange Server 2013 SP1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and Exchange Server 2016.

What is the main risk associated with CVE-2016-0032?

The main risk of CVE-2016-0032 is that remote attackers can inject arbitrary web scripts or HTML into Outlook Web Access.

Is there a workaround for CVE-2016-0032?

There are no known workarounds for CVE-2016-0032, and immediate patching is recommended to mitigate the risk.