« Volver al listado

CVE-2015-6061

Estado: ModificadaMedia (4.3)—

Cross-site scripting (XSS) vulnerability in Microsoft Skype for Business 2016, Lync 2010 and 2013 SP1, Lync 2010 Attendee, and Lync Room System allows remote attackers to inject arbitrary web script or HTML via an instant-message session, aka "Server Input Validation Information Disclosure Vulnerability."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Microsoft — LyncMicrosoft — Lync Room SystemMicrosoft — Skype FOR Business

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-6061",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-11-11T11:59:33.333",
  "references": [
    {
      "url": "http://www.securitytracker.com/id/1034126",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1034127",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-123",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1034126",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1034127",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-123",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in Microsoft Skype for Business 2016, Lync 2010 and 2013 SP1, Lync 2010 Attendee, and Lync Room System allows remote attackers to inject arbitrary web script or HTML via an instant-message session, aka \"Server Input Validation Information Disclosure Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de XSS en Microsoft Skype for Business 2016, Lync 2010 y 2013 SP1, Lync 2010 Attendee y Lync Room System permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una sesión de mensaje instantáneo, también conocida como 'Server Input Validation Information Disclosure Vulnerability'."
    }
  ],
  "lastModified": "2026-06-17T00:30:19.827",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:lync:2010:*:*:*:*:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "4426F8EF-9C49-4C77-B6D0-1A1865D02541"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:lync:2010:*:*:*:*:*:x86:*",
              "vulnerable": true,
              "matchCriteriaId": "860C65B6-5CEA-4A9F-AC37-EF185132E8CF"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:lync:2010:*:*:*:attendee:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C3ED4FC-2583-4E51-8931-082875A97034"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "1B0382F7-00EA-4057-A23E-F728EA6B03E8"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:x86:*",
              "vulnerable": true,
              "matchCriteriaId": "359108EA-33F3-4F02-A069-C45399CB2EB3"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:lync_room_system:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EA1A9222-FA8D-419A-8DEF-7F74D601D85E"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:skype_for_business:2016:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D499807D-91F3-447D-B9F0-D612898C9339"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}