PT-2013-5356 · Microsoft · Office Web Apps+1

Published 2013-12-10 · Updated 2018-10-12 · CVE-2013-5059

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server versions 2010 SP1 through 2010 SP2 Microsoft SharePoint Server version 2013 Office Web Apps version 2013

Description The issue allows remote attackers to execute arbitrary code via crafted page content. Remote code execution vulnerabilities exist, enabling an authenticated attacker to run arbitrary code in the security context of the W3WP service account.

Recommendations For Microsoft SharePoint Server versions 2010 SP1 and 2010 SP2, update to a version that includes the fix for this issue. For Microsoft SharePoint Server version 2013, apply the necessary security patches to resolve the vulnerability. For Office Web Apps version 2013, ensure that all security updates are applied to mitigate the risk of exploitation.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2013-5059

Affected Products

Sharepoint Server

Office Web Apps

References · 5

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5059 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-5059 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-100 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5059 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms13-100 · Note