Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
| Vendor | Product | Versions |
|---|---|---|
| microsoft | exchange | -, -, -, - |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| microsoft | microsoft exchange server 2019 cumulative update | mitre_affected | 90% |
| microsoft | microsoft exchange server subscription edition rtm | mitre_affected | 90% |
| microsoft | exchange | cert_advisory | 90% |
Updated severity to CRITICAL, added affected version Subscription Edition RTM, and noted that a permanent fix is still in the works.
Updated affected versions to include Exchange Server 2016, 2019, and Subscription Edition, and added patch information along with a new tag for EEMS.
Initial creation
