CVE-2013-5042

Loading...

General

Score:4.3/10.0
Severity:Low
Category:XSS Injection

Impact Metrics

Confidentiality:None
Integrity:Partial
Availability:None

Exploitability Metrics

Access Vector:Network
Access Complexity:Medium
Authentication:None

Published on 11/12/13 - Updated on 13/10/18

Description

Cross-site scripting (XSS) vulnerability in Microsoft ASP.NET SignalR 1.1.x before 1.1.4 and 2.0.x before 2.0.1, and Visual Studio Team Foundation Server 2013, allows remote attackers to inject arbitrary web script or HTML via crafted Forever Frame transport protocol data, aka "SignalR XSS Vulnerability."

Category: XSS Injection

CWE-79 (Cross-Site Scripting (XSS))
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Security Notices

US National Vulnerability DatabaseCVE-2013-5042
Agence Nationale de la Sécurité des Systèmes d'Information CERTA-2013-AVI-669
Microsoft MS13-103
Renater 2013/VULN547

Exploits

No exploits available for this CVE in our database.

Relative technologies

VendorProduct
microsoftasp.net_signalr
microsoftvisual_studio_team_foundation_server

Share this vulnerability with:

Twitter Facebook LinkedIn Mail