CVE-2015-6037

Microsoft Excel Web App - Authenticated Cross-Site Scripting via Crafted URL

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in Microsoft Excel Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, Excel Web App 2010 SP2, Office Web Apps Server 2013 SP1, and SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka "Microsoft Office Web Apps XSS Spoofing Vulnerability."

References (3)

Core 3

Core References

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-110

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1033804

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1033803

Scores

EPSS 0.0847

EPSS Percentile 94.5%

Details

CWE

CWE-79

Status published

Products (6)

microsoft/excel_web_app 2010 sp2

microsoft/office_web_apps 2010 sp2

microsoft/office_web_apps 2013 sp1

microsoft/sharepoint_foundation 2013 sp1

microsoft/sharepoint_server 2010 sp2

microsoft/sharepoint_server 2013 sp1

Published Oct 14, 2015

Tracked Since Feb 18, 2026