Description
Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| Microsoft Exchange Server 2016 Cumulative Update 23 | Microsoft / Microsoft Exchange Server 2016 Cumulative Update 23 | >= 15.01.0.0, < 15.01.2507.069 | affected |
| Microsoft Exchange Server 2019 Cumulative Update 14 | Microsoft / Microsoft Exchange Server 2019 Cumulative Update 14 | >= 15.02.0.0, < 15.02.1544.041 | affected |
| Microsoft Exchange Server 2019 Cumulative Update 15 | Microsoft / Microsoft Exchange Server 2019 Cumulative Update 15 | >= 15.02.0.0, < 15.02.1748.046 | affected |
| Microsoft Exchange Server Subscription Edition RTM | Microsoft / Microsoft Exchange Server Subscription Edition RTM | >= 15.02.0.0, < 15.02.2562.043 | affected |