CVE-2013-5072

2013-12-1100:55:04

CWE-79

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

Confidence

High

EPSS

0.822

Percentile

98.5%

JSON

Cross-site scripting (XSS) vulnerability in Outlook Web Access in Microsoft Exchange Server 2010 SP2 and SP3 and 2013 Cumulative Update 2 and 3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka “OWA XSS Vulnerability.”

Affected configurations

Nvd

Node

microsoftexchange_serverMatch2010sp2

microsoftexchange_serverMatch2010sp3

microsoftexchange_serverMatch2013cumulative_update_2

microsoftexchange_serverMatch2013cumulative_update_3

VendorProductVersionCPE
microsoftexchange_server2010cpe:2.3:a:microsoft:exchange_server:2010:sp2:*:*:*:*:*:*
microsoftexchange_server2010cpe:2.3:a:microsoft:exchange_server:2010:sp3:*:*:*:*:*:*
microsoftexchange_server2013cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_2:*:*:*:*:*:*
microsoftexchange_server2013cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_3:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	exchange_server	2010	cpe:2.3:a:microsoft:exchange_server:2010:sp2::::::
microsoft	exchange_server	2010	cpe:2.3:a:microsoft:exchange_server:2010:sp3::::::
microsoft	exchange_server	2013	cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_2::::::
microsoft	exchange_server	2013	cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_3::::::