CVE-2015-6061

2015-11-1111:59:33

CWE-79

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.5

Confidence

High

EPSS

0.044

Percentile

92.6%

JSON

Cross-site scripting (XSS) vulnerability in Microsoft Skype for Business 2016, Lync 2010 and 2013 SP1, Lync 2010 Attendee, and Lync Room System allows remote attackers to inject arbitrary web script or HTML via an instant-message session, aka “Server Input Validation Information Disclosure Vulnerability.”

Affected configurations

Nvd

Node

microsoftlyncMatch2010x64

microsoftlyncMatch2010x86

microsoftlyncMatch2010attendee

microsoftlyncMatch2013sp1x64

microsoftlyncMatch2013sp1x86

microsoftlync_room_systemMatch-

microsoftskype_for_businessMatch2016

VendorProductVersionCPE
microsoftlync2010cpe:2.3:a:microsoft:lync:2010:*:*:*:*:*:x64:*
microsoftlync2010cpe:2.3:a:microsoft:lync:2010:*:*:*:*:*:x86:*
microsoftlync2010cpe:2.3:a:microsoft:lync:2010:*:*:*:attendee:*:*:*
microsoftlync2013cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:x64:*
microsoftlync2013cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:x86:*
microsoftlync_room_system-cpe:2.3:a:microsoft:lync_room_system:-:*:*:*:*:*:*:*
microsoftskype_for_business2016cpe:2.3:a:microsoft:skype_for_business:2016:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	lync	2010	cpe:2.3:a:microsoft:lync:2010::::::x64:
microsoft	lync	2010	cpe:2.3:a:microsoft:lync:2010::::::x86:
microsoft	lync	2010	cpe:2.3:a:microsoft:lync:2010::::attendee:::
microsoft	lync	2013	cpe:2.3:a:microsoft:lync:2013:sp1:::::x64:*
microsoft	lync	2013	cpe:2.3:a:microsoft:lync:2013:sp1:::::x86:*
microsoft	lync_room_system	-	cpe:2.3:a:microsoft:lync_room_system:-:::::::*
microsoft	skype_for_business	2016	cpe:2.3:a:microsoft:skype_for_business:2016:::::::*