CVE-2015-6037
Low
Description
Cross-site scripting (XSS) vulnerability in Microsoft Excel Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, Excel Web App 2010 SP2, Office Web Apps Server 2013 SP1, and SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka "Microsoft Office Web Apps XSS Spoofing Vulnerability."
SeverityLow
CVSS3.5
Exploit probability96. percentile9.9%
Product
Microsoft Excel Web App
PublishedOct 14, 2015
First seenOct 14, 2015
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| microsoft excel_web_app | 2010 | — |
| microsoft office_web_apps | 2010, 2013 | — |
| microsoft sharepoint_foundation | 2013 | — |
| microsoft sharepoint_server | 2010, 2013 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.