CVE-2015-1764: Microsoft Exchange Server

Medium severity, CVSS 4.3. EPSS: 13.5% chance of exploitation in the next 30 days.

The web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allow remote attackers to bypass the Same Origin Policy and send HTTP traffic to intranet servers via a crafted request, related to a Server-Side Request Forgery (SSRF) issue, aka "Exchange Server-Side Request Forgery Vulnerability."

Affected products

• Microsoft Exchange Server: version 2013 only

Published 2015-06-10. Last modified 2026-06-17.