CVE-2015-6117CWE-79cross-site-scripting

CVE-2015-6117

Medium · published January 13, 2016

CVSS v3.0
6.1
EPSS
7%
Percentile
94.0
In the wild
Unconfirmed
What it is

Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart, aka "Microsoft SharePoint Security Feature Bypass," a different vulnerability than CVE-2016-0011.

The record
Technical detail
CVSS v3.0
6.1 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.06873 · 94.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2016-01-13T10:59Z
Affected products (2)
ProductVersionsFixed in
microsoft/sharepoint_foundationall versions—
microsoft/sharepoint_serverall versions—
References (4)
http://www.securitytracker.com/id/1034653 · [email protected]https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-004 · [email protected]http://www.securitytracker.com/id/1034653 · af854a3a-2127-422b-91ae-364da2661108https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-004 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 13 JAN 02:00Z
    Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions…
    cvelistv5