CVE-2014-1823 Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2010 and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing...
MediumCVSS 4.3
EPSS 51.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2010 and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing a valid meeting ID, aka "Lync Server Content Sanitization Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft lync server | = 2010 | No fix listed |
| Microsoft lync server | = 2013 | No fix listed |
References
- blogs.technet.com vendor-advisory
- 58537 third-party-advisory
- 67893 vdb-entry
- 1030381 vdb-entry
- MS14-032 vendor-advisory