CVE-2014-1823

CWE-79 — Cross-site Scripting (XSS)6 documents5 sources
Severity
4.3MEDIUM
EPSS
28.4%
top 3.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Microsoft Lync Server
Timeline
PublishedJun 11
Latest updateMay 14

Description

Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2010 and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing a valid meeting ID, aka "Lync Server Content Sanitization Vulnerability."

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDmicrosoft/lync_server2010, 2013+1

🔴Vulnerability Details

2
GHSA
GHSA-hj87-75g2-729c: Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2010 and 2013 allows remote attackers to inject arbitra↗2022-05-14
▶
CVEList
CVE-2014-1823: Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2010 and 2013 allows remote attackers to inject arbitra↗2014-06-11
▶

📋Vendor Advisories

2
Red Hat
Mozilla: Script execution in HTML mail replies (MFSA 2014-14)↗2014-02-06
▶
Red Hat
Mozilla: Script execution in HTML mail replies (MFSA 2014-14)↗2014-02-06
▶
CVE-2014-1823 (MEDIUM CVSS 4.3) | Cross-site scripting (XSS) vulnerab | cvebase.io