CVEvulnerability
CVE-2013-3159
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2013-09-11
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-20
Description
Microsoft Excel 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Excel Viewer; and Microsoft Office Compatibility Pack SP3 allow remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka "XML External Entities Resolution Vulnerability."
Affected configurations
• microsoft excel 2003
• microsoft excel 2007
• microsoft excel 2010
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://www.us-cert.gov/ncas/alerts/TA13-253A US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-073 docs.microsoft.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18686 oval.cisecurity.org
- http://www.us-cert.gov/ncas/alerts/TA13-253A US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-073 docs.microsoft.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18686 oval.cisecurity.org