VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Mar 12, 2020· Updated Jun 17, 2026

CVE-2020-0903

CVE-2020-0903

Description

A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'.

Affected products

9
  • Microsoft/Exchange Server5 versions
    cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*
    • (no CPE)
  • Microsoft/Microsoft Exchange Server 2016 Cumulative Update 14v5
    Range: unspecified
  • Microsoft/Microsoft Exchange Server 2016 Cumulative Update 15v5
    Range: unspecified
  • Microsoft/Microsoft Exchange Server 2019 Cumulative Update 3v5
    Range: unspecified
  • Microsoft/Microsoft Exchange Server 2019 Cumulative Update 4v5
    Range: unspecified

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.