CVE-2013-0081: Microsoft SharePoint unassigned workflow handling denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

medium priorityUnauthenticated remote denial of service with partial availability impact, but no confirmed in-the-wild exploitation and only a medium CVSS 2.0 score.

What it is

SharePoint Portal Server 2003 SP3 and SharePoint Server 2007 SP3, 2010 SP1/SP2, and 2013 fail to properly process unassigned workflows. A crafted URL can hang the W3WP worker process, causing a denial of service. The flaw is an input validation issue (CWE-20) reachable over the network without authentication.

Impact

An unauthenticated remote attacker can hang the W3WP process, making the affected SharePoint site or service unavailable to legitimate users. The CVSS 2.0 vector shows partial availability impact only, with no confidentiality or integrity loss.

Attack surface

Reached over the network via a crafted URL against a SharePoint endpoint that handles unassigned workflows. The CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware usage is documented in the record. EPSS is high (0.76746, 99.5th percentile), suggesting elevated likelihood of attempted exploitation, but the record does not confirm in-the-wild activity.

What to do

• Apply Microsoft security bulletin MS13-067 for the affected SharePoint versions.
• Restrict network access to SharePoint workflow endpoints to trusted users and networks where feasible.
• Monitor W3WP process health and configure automatic recycling or recovery to limit hang duration.
• Retire or isolate unsupported SharePoint 2003/2007 deployments that cannot be patched.

Detection

• Alert on W3WP process hangs, unresponsiveness, or unexpected worker process recycling on SharePoint servers.
• Review IIS and SharePoint logs for crafted or anomalous URLs targeting workflow endpoints.
• Baseline normal workflow request patterns and flag unusual unassigned-workflow requests.
• Correlate repeated availability failures on SharePoint front ends with source IPs for triage.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.