Microsoft / Microsoft Exchange Server 2016 Cumulative Update 23 · Microsoft / Microsoft Exchange Server 2019 Cumulative Update 14 · Microsoft / Microsoft Exchange Server 2019 Cumulative Update 15 · +1
6.1 · CVSS 3.1MediumCISA KEV
CISA lists this CVE as exploited in the wild. Patch it before anything rated by score alone.
Description
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.