« Volver al listado

CVE-2013-1301

Estado: ModificadaMedia (4.3)—

Microsoft Visio 2003 SP3 2007 SP3, and 2010 SP1 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, aka "XML External Entities Resolution Vulnerability."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microsoft — Visio

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-1301",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-05-15T03:36:33.410",
  "references": [
    {
      "url": "http://www.us-cert.gov/ncas/alerts/TA13-134A",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-044",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16750",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.us-cert.gov/ncas/alerts/TA13-134A",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-044",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16750",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft Visio 2003 SP3 2007 SP3, and 2010 SP1 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, aka \"XML External Entities Resolution Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "Microsoft Visio 2003 SP3 2007 SP3, y 2010 SP1 permite a atacantes remotos leer ficheros de su elección mediante un documento XML conteniendo una declaración de entidad externa junto con una referencia de entidad, también conocido como \"Vulnerabilidad de reslución de entidad XML externa\""
    }
  ],
  "lastModified": "2026-06-16T23:51:10.887",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:visio:2003:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "553ADEFC-11EC-4E29-8A95-4AF59DB6CEAE"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visio:2007:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "387D78BD-2368-4525-BFC2-52149585E1F0"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visio:2010:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "309E4A2E-60B9-4F68-BAC6-7BC997849B19"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}