Executive Summary
Summary | |
---|---|
Title | Vulnerabilities in System Center Operations Manager Could Allow Elevation of Privilege (2748552) |
Informations | |||
---|---|---|---|
Name | MS13-003 | First vendor Publication | 2013-01-08 |
Vendor | Microsoft | Last vendor Modification | 2013-03-12 |
Severity (Vendor) | Important | Revision | 2.0 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
---|---|---|---|
Cvss Base Score | 4.3 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Revision Note: V2.0 (March 12, 2013): Rereleased this bulletin to announce availability of an update for Microsoft System Center Operations Manager 2007 Service Pack 1. No other update packages are affected by this rerelease. |
Original Source
Url : http://technet.microsoft.com/en-us/security/bulletin/ms13-003 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:15760 | |||
Oval ID: | oval:org.mitre.oval:def:15760 | ||
Title: | System Center Operations Manager Web Console XSS Vulnerability-I - MS13-003 | ||
Description: | Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject arbitrary web script or HTML via crafted input, aka "System Center Operations Manager Web Console XSS Vulnerability," a different vulnerability than CVE-2013-0010. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2013-0009 | Version: | 3 |
Platform(s): | Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 | Product(s): | Microsoft System Center Operations Manager 2007 Microsoft System Center Operations Manager 2007 R2 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:16232 | |||
Oval ID: | oval:org.mitre.oval:def:16232 | ||
Title: | System Center Operations Manager Web Console XSS Vulnerability-II - MS13-003 | ||
Description: | Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject arbitrary web script or HTML via crafted input, aka "System Center Operations Manager Web Console XSS Vulnerability," a different vulnerability than CVE-2013-0009. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2013-0010 | Version: | 3 |
Platform(s): | Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 | Product(s): | Microsoft System Center Operations Manager 2007 Microsoft System Center Operations Manager 2007 R2 |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 2 |
Information Assurance Vulnerability Management (IAVM)
Date | Description |
---|---|
2013-01-10 | IAVM : 2013-B-0002 - Microsoft System Center Operations Manager Privilege Escalation Vulnerabilities Severity : Category II - VMSKEY : V0036448 |
Snort® IPS/IDS
Date | Description |
---|---|
2015-01-13 | Microsoft Windows XP .theme file remote code execution attempt RuleID : 32730 - Revision : 3 - Type : FILE-OTHER |
2014-01-10 | Microsoft SCOM Web Console cross-site scripting attempt RuleID : 25273 - Revision : 3 - Type : SERVER-WEBAPP |
2014-01-10 | Microsoft System Center Operations Manger cross site scripting attempt RuleID : 25272 - Revision : 5 - Type : SERVER-WEBAPP |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2013-01-09 | Name : A web application hosted on the remote Windows system has multiple cross-site... File : smb_nt_ms13-003.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:47:31 |
|
2014-01-19 21:30:55 |
|
2013-11-11 12:41:31 |
|
2013-03-12 22:08:53 |
|
2013-03-12 22:05:19 |
|
2013-01-10 17:23:09 |
|
2013-01-09 21:20:49 |
|
2013-01-08 21:18:39 |
|