CVE-2013-3180: Microsoft SharePoint Server POST cross-site scripting flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityCVSS 2.0 rates it medium (4.3) with integrity-only impact, but the high EPSS percentile and broad SharePoint deployment justify prompt patching.

What it is

Microsoft SharePoint Server 2010 SP1/SP2 and 2013 contain a cross-site scripting vulnerability reachable through a crafted POST request, tracked as the "POST XSS Vulnerability." An attacker can inject arbitrary web script or HTML into a SharePoint response, which matters because SharePoint is a widely deployed collaboration platform where script execution occurs in the context of authenticated users. The record does not specify the exact vulnerable endpoint or parameter, only the POST vector.

Impact

An attacker can execute arbitrary script in a victim's browser session, enabling theft of session tokens, credential harvesting, or actions performed as the victim within SharePoint. The CVSS 2.0 vector rates integrity impact only (I:P), with no confidentiality or availability impact stated.

Attack surface

The flaw is network-reachable (AV:N) with no authentication required (Au:N) but requires some user interaction or a non-trivial condition (AC:M), consistent with a crafted POST request that must be delivered to or triggered by a victim. No specific endpoint, parameter, or required privilege is given in the record.

Exploitation

Not listed in CISA KEV and no public exploit or exploitation tag appears in the references, which are vendor and government advisories only. EPSS is high (0.65573, 99.2nd percentile), indicating elevated predicted exploitation likelihood despite the absence of confirmed in-the-wild activity.

What to do

• Apply Microsoft security bulletin MS13-067 for SharePoint Server 2010 SP1/SP2 and 2013, which is the vendor fix for this issue.
• If immediate patching is not possible, restrict or monitor POST traffic to SharePoint and apply input validation or WAF rules blocking script payloads in POST bodies.
• Enforce output encoding and request validation on SharePoint customizations and web parts, since the flaw is a POST-based XSS.
• Reduce exposure by limiting anonymous or untrusted access to SharePoint sites until patched.

Detection

• Inspect web and proxy logs for POST requests to SharePoint endpoints containing script tags, event handlers, or encoded HTML in parameters.
• Monitor for anomalous script execution or unexpected client-side redirects originating from SharePoint pages.
• Alert on SharePoint error or audit events correlating with unusual POST patterns from single source IPs.
• Review SharePoint ULS logs for request validation failures or suspicious POST handling around the affected versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.