« Volver al listado

CVE-2015-2536

Estado: ModificadaMedia (4.3)—

Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server and Lync Server XSS Elevation of Privilege Vulnerability."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Microsoft — Lync ServerMicrosoft — Skype FOR Business Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-2536",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-09-09T00:59:47.270",
  "references": [
    {
      "url": "http://www.securitytracker.com/id/1033497",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-104",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1033497",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-104",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka \"Skype for Business Server and Lync Server XSS Elevation of Privilege Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de XSS en Microsoft Lync Server 2013 y Skype para Business Server 2015, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de una URL manipulada, también conocida como 'Skype for Business Server and Lync Server XSS Elevation of Privilege Vulnerability.'"
    }
  ],
  "lastModified": "2026-06-17T00:24:16.000",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:lync_server:2013:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "677D4F3D-1374-4F6F-B69E-7F9F507D18A4"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:skype_for_business_server:2015:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42983553-64FE-4FC5-9C05-119D5828F9AE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}