CVE-2013-0007

CWE-94 — Code Injection3 documents3 sources
Severity
9.3CRITICAL
EPSS
24.2%
top 3.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Microsoft Expression WEBMicrosoft Groove ServerMicrosoft Office+3 more
Timeline
PublishedJan 9
Latest updateMay 5

Description

Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML XSLT Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages6 packages

▶NVDmicrosoft/xml_core_services4 versions+3
▶NVDmicrosoft/office2003, 2007+1

🔴Vulnerability Details

2
GHSA
GHSA-xxmc-w557-89q7: Microsoft XML Core Services (aka MSXML) 4↗2022-05-05
▶
CVEList
CVE-2013-0007: Microsoft XML Core Services (aka MSXML) 4↗2013-01-09
▶
CVE-2013-0007 (CRITICAL CVSS 9.3) | Microsoft XML Core Services (aka MS | cvebase.io