What is the CVSS score of CVE-2013-0007?

CVE-2013-0007 has a CVSS 2.0 base score of 9.3 (Critical). CVSS vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. EPSS exploitation probability: 24.2%.

Xml Core Services CVE-2013-0007

CRITICAL

Code Injection (CWE-94)

2013-01-09 secure@microsoft.com

Code Injection Microsoft RCE Xml Core Services Windows 7 Windows 8 Windows Server 2003 Windows Server 2008 Windows Server 2012 Windows Vista Windows Xp Windows Rt Expression Web Groove Server Office Office Compatibility Pack Sharepoint Server Word Viewer

9.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:M/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:C/I:C/A:C

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Jan 09, 2013 - 18:09 cve.org

CRITICAL 9.3

DescriptionCVE.org

AnalysisAI

Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML XSLT. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 24.2% and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML XSLT Vulnerability." Affected products include: Microsoft Xml Core Services, Microsoft Windows 7, Microsoft Windows 8, Microsoft Windows Server 2003, Microsoft Windows Server 2008.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.