CVE-2013-3160 — Sensitive Information Exposure in Microsoft Office

CWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
5.0MEDIUMNVD
EPSS
27.6%
top 3.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Microsoft OfficeMicrosoft Word
Timeline
PublishedSep 11
Latest updateMay 14

Description

Microsoft Office 2003 SP3 and 2007 SP3, Word 2003 SP3 and 2007 SP3, and Word Viewer allow remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka "XML External Entities Resolution Vulnerability."

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶NVDmicrosoft/word2003, 2007+1
▶NVDmicrosoft/office2003, 2007+1

🔴Vulnerability Details

2
GHSA
GHSA-8mc7-rqj3-66wm: Microsoft Office 2003 SP3 and 2007 SP3, Word 2003 SP3 and 2007 SP3, and Word Viewer allow remote attackers to read arbitrary files via an XML document↗2022-05-14
▶
CVEList
CVE-2013-3160: Microsoft Office 2003 SP3 and 2007 SP3, Word 2003 SP3 and 2007 SP3, and Word Viewer allow remote attackers to read arbitrary files via an XML document↗2013-09-11
▶

💬Community

1
Bugzilla
CVE-2013-4386 Foreman: host and host group parameter SQL injection↗2013-09-27
▶
CVE-2013-3160 — Sensitive Information Exposure | cvebase