CVE-2015-6037
Cross-site scripting (XSS) vulnerability in Microsoft Excel Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, Excel Web App 2010 SP2, Office Web Apps Server 2013 SP1, and SharePoint Foundation 2013 SP1 allows remote…
Does this matter?
Lower severity and a low EPSS score (8.47%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in Microsoft Excel Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, Excel Web App 2010 SP2, Office Web Apps Server 2013 SP1, and SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka "Microsoft Office Web Apps XSS Spoofing Vulnerability."
- CVSS 2.0
- 3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
- EPSS
- 8.47% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- microsoft/excel web app · microsoft/office web apps · microsoft/sharepoint foundation · microsoft/sharepoint server
- Source
- secure@microsoft.com
References
- http://www.securitytracker.com/id/1033803Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033804Third Party Advisory, VDB Entry
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-110
- http://www.securitytracker.com/id/1033803Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033804Third Party Advisory, VDB Entry
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-110
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.