« Volver al listado

CVE-2013-1302

Estado: ModificadaAlta (9.3)—

Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via an invitation that triggers access to a deleted object, aka "Lync RCE Vulnerability."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Microsoft — LyncMicrosoft — Lync ServerMicrosoft — Office Communicator

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-1302",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-05-15T03:36:33.427",
  "references": [
    {
      "url": "http://www.us-cert.gov/ncas/alerts/TA13-134A",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-041",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15952",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.us-cert.gov/ncas/alerts/TA13-134A",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-041",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15952",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via an invitation that triggers access to a deleted object, aka \"Lync RCE Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, y Lync Server 2013 no maneja correctamente ojbetos en memoria, lo que permite a atacantes remotos ejecutar código arbitrario mediante una invitación que genera el acceso a un objeto eliminado, también conocido como \"Vulnerabilidad"
    }
  ],
  "lastModified": "2026-06-16T23:51:10.990",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:lync:2010:*:attendee:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE98CEE9-200B-494A-B645-D14ACB577250"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:lync:2010:*:x64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF2C62AD-CC37-42B4-88AD-75F8F603ADEB"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:lync:2010:*:x86:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F01B787D-6263-4753-977D-211432447E38"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:lync_server:2013:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "677D4F3D-1374-4F6F-B69E-7F9F507D18A4"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_communicator:2007:r2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7234718B-FD5B-4C9E-8D32-E0A9DDDA7619"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}