Vulnerability in Microsoft Exchange Server 2016 Cumulative Update 14

CVE-2020-0903

A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'.

EPSS: 0.007 (73.1th percentile) — read the EPSS interpretation.

Affected products

Microsoft Exchange Server 2016 Cumulative Update 14 — versions unspecified
Microsoft Exchange Server 2016 Cumulative Update 15 — versions unspecified
Microsoft Exchange Server 2019 Cumulative Update 3 — versions unspecified
Microsoft Exchange Server 2019 Cumulative Update 4 — versions unspecified

References

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0903 (x_refsource_MISC)