CVE-2013-1330: microsoft office_web_apps Improper Input Validation
Vulnerability summary
CVE-2013-1330 is a high (CVSS 10.0) Improper Input Validation vulnerability in microsoft office_web_apps. EPSS estimates a 30.20% chance of exploitation in the next 30 days, higher than 98.2% of scored vulnerabilities.
Timeline
- 11-09-2013PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP2, and Office Web Apps 2010 does not set the EnableViewStateMac attribute, which allows remote attackers to execute arbitrary code by leveraging an unassigned workflow, aka "MAC Disabled Vulnerability."
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
30.20%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
+2.79 pp
From 27.41% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Microsoft5 products
- office_web_apps2010:sp1
- sharepoint_foundation2010:sp1 | 2010:sp2
- sharepoint_portal_server2003:sp3
- sharepoint_server2007:sp3 | 2010:sp1 | 2010:sp2
- sharepoint_services2.0 | 3.0
1 vendor · 5 products
References
4 links- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19040VDB EntrySignatureX Refsource OVAL
docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-105Vendor AdvisoryX Refsource MS- docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-067Vendor AdvisoryX Refsource MS