CVE-2015-2531

2015-09-0900:59:43

CWE-79

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

4.9

Confidence

High

EPSS

0.027

Percentile

90.5%

JSON

Cross-site scripting (XSS) vulnerability in the jQuery engine in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka “Skype for Business Server and Lync Server XSS Information Disclosure Vulnerability.”

Affected configurations

Nvd

Node

microsoftlync_serverMatch2013

microsoftskype_for_business_serverMatch2015

VendorProductVersionCPE
microsoftlync_server2013cpe:2.3:a:microsoft:lync_server:2013:*:*:*:*:*:*:*
microsoftskype_for_business_server2015cpe:2.3:a:microsoft:skype_for_business_server:2015:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	lync_server	2013	cpe:2.3:a:microsoft:lync_server:2013:::::::*
microsoft	skype_for_business_server	2015	cpe:2.3:a:microsoft:skype_for_business_server:2015:::::::*