CVE-2020-0903

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
MicrosoftMicrosoft Exchange Server 2019 Cumulative Update 4unspecified
MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 15unspecified
MicrosoftMicrosoft Exchange Server 2019 Cumulative Update 3unspecified
MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 14unspecified

References

Timeline

Published
Mar 12, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-09046.5<p>A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate specific malicious data from CVE-2020-09058.0An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka 'Dynamics Business Central Remote Code Execution VCVE-2020-09068.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'CVE-2020-09077.8A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft GraphicsCVE-2020-09087.5<p>A remote code execution vulnerability exists when the Windows Text Service Module improperly handles memory. An attacker who successfullyCVE-2020-09097.5A denial of service vulnerability exists when Hyper-V on a Windows Server fails to properly handle specially crafted network packets. To expCVE-2020-09108.4A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated usCVE-2020-09117.8<p>An elevation of privilege vulnerability exists when Windows Modules Installer improperly handles objects in memory. An attacker who succeCVE-2020-09127.0<p>An elevation of privilege vulnerability exists when the Windows Function Discovery SSDP Provider improperly handles memory.</p> <p>To expCVE-2020-09137.8An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel ElevaCVE-2020-09145.5<p>An information disclosure vulnerability exists when the Windows State Repository Service improperly handles objects in memory. An attackeCVE-2020-09157.8An elevation of privilege vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, aka 'W
CVE-2020-0903: Medium severity, CVSS 5.4 | Vulnix