What is the CVSS score of CVE-2013-3661?

CVE-2013-3661 has a CVSS 2.0 base score of 4.9 (Medium). CVSS vector: AV:L/AC:L/Au:N/C:N/I:N/A:C. EPSS exploitation probability: 1.8%.

Is there a public PoC exploit available for CVE-2013-3661?

Yes, a public proof-of-concept exploit is available for CVE-2013-3661. Prioritise patching immediately. EPSS: 1.8%.

Windows Server 2008 CVE-2013-3661

MEDIUM

Path Traversal (CWE-22)

2013-05-24 cve@mitre.org

Denial Of Service Path Traversal Microsoft Windows Server 2008 Windows Server 2012 Windows 7 Windows Xp Windows Server 2003 Windows Vista Windows 8 Windows Rt

4.9

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:L/AC:L/Au:N/C:N/I:N/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Confidentiality

None

Integrity

None

Availability

Lifecycle Timeline

CVE Published

May 24, 2013 - 20:55 cve.org

MEDIUM 4.9

DescriptionCVE.org

The EPATHOBJ::bFlatten function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not check whether linked-list traversal is continually accessing the same list member, which allows local users to cause a denial of service (infinite traversal) via vectors that trigger a crafted PATHRECORD chain.

AnalysisAI

The EPATHOBJ::bFlatten function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows. Rated medium severity (CVSS 4.9), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. The EPATHOBJ::bFlatten function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not check whether linked-list traversal is continually accessing the same list member, which allows local users to cause a denial of service (infinite traversal) via vectors that trigger a crafted PATHRECORD chain. Affected products include: Microsoft Windows 7, Microsoft Windows 8, Microsoft Windows Rt, Microsoft Windows Server 2003, Microsoft Windows Server 2008.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.