← Back

CVE-2013-1330

nvd nist
Published: Sep 11, 2013Modified: Apr 29, 2026

JSON object

Loading...
10.0
Vector
AV:N/AC:L/Au:N/C:C/I:C/A:C
Exploitability: 10.0 / Impact: 10.0
Source: NVD

Description

The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP2, and Office Web Apps 2010 does not set the EnableViewStateMac attribute, which allows remote attackers to execute arbitrary code by leveraging an unassigned workflow, aka "MAC Disabled Vulnerability."

Affected (9)

Microsoft
5 products
Sharepoint Foundation
Sharepoint Portal Server
Sharepoint Server
Sharepoint Services
Office Web Apps
Configuration A
8 vulnerable
Vulnerable SoftwareAffected Versions
Microsoft
Sharepoint Foundation
Version 2010 sp1
Sharepoint Foundation
Version 2010 sp2
Sharepoint Portal Server
Version 2003 sp3
Microsoft
Sharepoint Server
Version 2007 sp3
Sharepoint Server
Version 2010 sp1
Sharepoint Server
Version 2010 sp2
Microsoft
Sharepoint Services
Version 2.0
Sharepoint Services
Version 3.0
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Office Web Apps
Version 2010 sp1
Running on/withPlatform Versions
Microsoft
Office Web Apps
Version 2010 sp2

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (8)

Source: secure@microsoft.com
US Government Resource
Source: secure@microsoft.com
Source: secure@microsoft.com
Source: secure@microsoft.com
Source: af854a3a-2127-422b-91ae-364da2661108
US Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.