VULNpocalypse

CVE-2013-3180: vulnerability

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

Generated by VEDAS. Scores as of 2026-11-11 15:49 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.

What it is

Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1 and SP2 and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted POST request, aka “POST XSS Vulnerability.”

Description quoted from the CVE record (assigned by microsoft, published 2013-09-11).

How it can be exploited

Public exploit evidence (Exploit Observer)

Exploit Observer found 5 code repositories naming this CVE.

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 9 references on Exploit Observer

Live scores

EPSS
0.697
very likely to be attacked soon
VEDAS
0.983
strong exploit evidence
On CISA KEV
Not listed
Detection rule
Nuclei · Suricata

Who is affected

ProductAffectedNot affected
Not statedversions not stated in the recordNot stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Vendor guidance:

  • MS13-067 (vendor-advisory, x_refsource_MS)

How to detect it

Nuclei template (active check)

Microsoft SharePoint Server 2010 SP1 - Cross-Site Scripting

Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1 and SP2 and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted POST request, aka “POST XSS Vulnerability.”

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (GET /index.php?q=); it decides using status, word matchers. Severity in the template: medium. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash
nuclei -u https://your-host -t CVE-2013-3180.yaml
Show the template (39 lines)
yaml
id: CVE-2013-3180

info:
  name: "Microsoft SharePoint Server 2010 SP1 - Cross-Site Scripting"
  author: vedas-arpsyndicate
  severity: medium
  description: |
    Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1 and SP2 and 2013 allows
    remote attackers to inject arbitrary web script or HTML via a crafted POST request, aka "POST XSS
    Vulnerability."
  reference:
    - https://www.exploit.observer/?keyword=CVE-2013-3180&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=microsoft&match=exact
  classification:
    cvss-score: 4.3
    cve-id: CVE-2013-3180
    cwe-id: CWE-79
  metadata:
    verified: false
    max-request: 1
  tags: cve,cve2013,microsoft,xss

http:
  - method: GET
    path:
      - '{{BaseURL}}/index.php?q="><script>confirm(xgcrfeiy)</script>'
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"><script>confirm(xgcrfeiy)</script>'
      - type: word
        part: header
        words:
          - "text/html"
      - type: status
        status:
          - 200

CVE-2013-3180.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2013-3180 Microsoft SharePoint Server 2010 SP1 - Cross-Site Scripting. Add them to your Suricata rule set and reload.

Show the rules
suricata
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2013-3180 Microsoft SharePoint Server 2010 SP1 - Cross-Site Scripting"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"index.php"; nocase; fast_pattern; content:"<script"; nocase; classtype:web-application-attack; reference:cve,CVE-2013-3180; reference:url,https://www.exploit.observer/?keyword=CVE-2013-3180&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=microsoft&match=exact; sid:1004279; rev:2;)

CVE-2013-3180.rules on GitHub

References

Vendor advisories and patches

  • MS13-067 (vendor-advisory, x_refsource_MS)

Technical analysis and advisories

  • TA13-253A (third-party-advisory, x_refsource_CERT)

Other references

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.

Supporting partners

Feasible SecurityAskealGoTrust