PT-2015-5770 · Microsoft · Biztalk Server 2013 R2+3

Published 2015-08-15 · Updated 2018-10-12 · CVE-2015-2475

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2008 SP2 BizTalk Server 2010 BizTalk Server 2013 Gold BizTalk Server 2013 R2

Description A cross-site scripting (XSS) issue exists in the UDDI Services component, allowing remote attackers to inject arbitrary web script or HTML via the search parameter in uddi/search/frames.aspx. This enables attackers to potentially elevate privileges.

Recommendations For Microsoft Windows Server 2008 SP2, update to a version that includes the fix for this issue. For BizTalk Server 2010, apply the patch that addresses the UDDI Services Elevation of Privilege issue. For BizTalk Server 2013 Gold and 2013 R2, restrict access to the uddi/search/frames.aspx endpoint until a patch is applied, and avoid using the search parameter in this endpoint to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-2475

Affected Products

Biztalk Server 2010

Biztalk Server 2013 Gold

Biztalk Server 2013 R2

Windows Server 2008 R2

References · 4

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-087 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2475 · Security Note
• http://securitytracker.com/id/1033246 · Note
• http://securityfocus.com/bid/76259 · Note