Description
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP2, and Office Web Apps 2010 does not set the EnableViewStateMac attribute, which allows remote attackers to execute arbitrary code by leveraging an unassigned workflow, aka "MAC Disabled Vulnerability."
References (4)
Core 4
Core References
US Government Resource third-party-advisory
x_refsource_cert
http://www.us-cert.gov/ncas/alerts/TA13-253A
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19040
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-105
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-067
Scores
EPSS
0.2741
EPSS Percentile
97.8%
Details
CWE
CWE-20
Status
published
Products (7)
microsoft/office_web_apps
2010 sp1
microsoft/sharepoint_foundation
2010 sp1 (2 CPE variants)
microsoft/sharepoint_portal_server
2003 sp3
microsoft/sharepoint_server
2007 sp3
microsoft/sharepoint_server
2010 sp1 (2 CPE variants)
microsoft/sharepoint_services
2.0
microsoft/sharepoint_services
3.0
Published
Sep 11, 2013
Tracked Since
Feb 18, 2026