CVE-2015-2434

Published: Aug 15, 2015Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Microsoft XML Core Services 3.0 and 5.0 supports SSL 2.0, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and conducting a decryption attack, aka "MSXML Information Disclosure Vulnerability," a different vulnerability than CVE-2015-2471.

Affected (2)

Products: Microsoft: Xml Core Services

1 product

Xml Core Services

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Microsoft Xml Core Services	Version 3.0
Microsoft Xml Core Services	Version 5.0

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

http://www.securitytracker.com/id/1033241

Source: secure@microsoft.com

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-084

Source: secure@microsoft.com

http://www.securitytracker.com/id/1033241

Source: af854a3a-2127-422b-91ae-364da2661108

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-084

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.