CVE-2015-6039
Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or HTML via crafted content in an Office Marketplace instance, aka…
Does this matter?
Lower severity and a low EPSS score (9.06%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or HTML via crafted content in an Office Marketplace instance, aka "Microsoft SharePoint Security Feature Bypass Vulnerability."
- CVSS 2.0
- 3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
- EPSS
- 9.06% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- microsoft/sharepoint foundation · microsoft/sharepoint server
- Source
- secure@microsoft.com
References
- http://www.securitytracker.com/id/1033804Third Party Advisory, VDB Entry
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-110
- http://www.securitytracker.com/id/1033804Third Party Advisory, VDB Entry
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-110
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.