PT-2013-5352 · Microsoft · Sharepoint Server+1

Noam Liran · Publicado 2013-12-10 · Atualizado 2018-10-12 · CVE-2013-5054

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Office versions 2013 and 2013 RT

Description The issue allows remote attackers to discover authentication tokens via a crafted response to a file-open request for an Office file on a website. This is an information disclosure vulnerability that occurs when affected Microsoft Office software does not properly handle a specially crafted response while attempting to open an Office file hosted on a malicious website. An attacker who successfully exploits this issue could ascertain access tokens used to authenticate the current user on a targeted SharePoint or other Microsoft Office server site. The issue has been exploited in the wild.

Recommendations For Microsoft Office 2013 and 2013 RT, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2013-5054

Produtos afetados

Office

Sharepoint Server

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-5054 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5054 · Nota de Segurança
• http://technet.microsoft.com/en-us/security/bulletin/ms13-104 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-104 · Aviso do Fabricante