Unscored severity · published Sep 9, 2015
CVE-2015-2522
Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or HTML via crafted content,…
–
CVSS
10.3%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or HTML via crafted content, aka "Microsoft SharePoint XSS Spoofing Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)10.3% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Sharepoint Foundation · Microsoft
2013 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2522
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2522
www.oracle.com
http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
www.securitytracker.com
http://www.securitytracker.com/id/1033489
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-099
More from Sharepoint Foundation
9.8
CVE-2019-0604
Microsoft SharePoint Remote Code Execution Vulnerability
9.9
CVE-2020-1595
<p>A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input
9.9
CVE-2020-1210
<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package
9.8
CVE-2023-21716
Microsoft Word Remote Code Execution Vulnerability
9.8
CVE-2020-1025
An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation