CVE-2013-3179

Microsoft SharePoint Server 2007 SP3, 2010 SP1/SP2, 2013 - Cross-Site Scripting

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2013-3179. PoCs published by Vulnerability-Lab.

AI-analyzed exploit summary This is a detailed writeup describing a persistent XSS vulnerability in Microsoft SharePoint 2013 (Cloud) due to improper input validation in the exception handling module. The vulnerability allows remote attackers to inject malicious script code via the `ms-descriptionText` and `TA_ManageBDCPermissions_data` parameters.

Description

Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "SharePoint XSS Vulnerability."

Exploits (1)

exploitdb WRITEUP
by Vulnerability-Lab · textwebappswindows
https://www.exploit-db.com/exploits/28238

This is a detailed writeup describing a persistent XSS vulnerability in Microsoft SharePoint 2013 (Cloud) due to improper input validation in the exception handling module. The vulnerability allows remote attackers to inject malicious script code via the `ms-descriptionText` and `TA_ManageBDCPermissions_data` parameters.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Moderate
Reliability
Reliable
Target: Microsoft SharePoint 2013 (Cloud)
Auth required
Prerequisites: Low-privileged SharePoint user account · Access to vulnerable module
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18750
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/ncas/alerts/TA13-253A

Scores

EPSS 0.2226
EPSS Percentile 97.4%

Details

CWE
CWE-79
Status published
Products (4)
microsoft/sharepoint_foundation 2010 sp1 (2 CPE variants)
microsoft/sharepoint_server 2007 sp3
microsoft/sharepoint_server 2010 sp1 (2 CPE variants)
microsoft/sharepoint_services 3.0
Published Sep 11, 2013
Tracked Since Feb 18, 2026