CVE-2015-2475

Microsoft BizTalk Server and Windows Server 2008 - Cross-Site Scripting via UDDI Search Parameter

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in uddi/search/frames.aspx in the UDDI Services component in Microsoft Windows Server 2008 SP2 and BizTalk Server 2010, 2013 Gold, and 2013 R2 allows remote attackers to inject arbitrary web script or HTML via the search parameter, aka "UDDI Services Elevation of Privilege Vulnerability."

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1033246

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-087

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/76259

Scores

EPSS 0.1464

EPSS Percentile 96.3%

Details

CWE

CWE-79

Status published

Products (3)

microsoft/biztalk_server 2010

microsoft/biztalk_server 2013 (2 CPE variants)

microsoft/windows_server_2008

Published Aug 15, 2015

Tracked Since Feb 18, 2026