CVE-2016-0032

MEDIUM

Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10-11, 2016 - Cross-Site Scripting via Crafted URL

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."

References (3)

Core 3

Core References

Patch, Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-010

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1034647

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/79884

Scores

CVSS v3 6.1

EPSS 0.0758

EPSS Percentile 93.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

microsoft/exchange_server 2013 cumulative_update_10 (3 CPE variants)

microsoft/exchange_server 2016

Published Jan 13, 2016

Tracked Since Feb 18, 2026