CVE-2013-3275 Cross-site scripting in n/a

What is CVE-2013-3275?

CVE-2013-3275 is a medium-severity cross-site scripting vulnerability in n/a, published on 18 Jul 2013. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

EMC Avamar Server and Avamar Virtual Edition before 7.0 on Data Store Gen3, Gen4, and Gen4s platforms do not properly restrict use of FRAME elements, which makes it easier for remote attackers to obtain sensitive information via a crafted web site, related to "cross frame scripting vulnerabilities."

Weakness: CWE-20

Which versions are affected by CVE-2013-3275?

It affects 2 products.

Products include Emc Avamar Server, Emc Avamar Server Virtual Edition.

How do I fix CVE-2013-3275?

No fix has been published for CVE-2013-3275 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2013-3275 being exploited?

There is no known exploitation of CVE-2013-3275 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2017-15548 Auth bypass in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0, EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x, EMC Integrated Data Protection Appliance 2.0 Critical 9.8
• CVE-2017-4989 Auth bypass in EMC Avamar Server Software 7.3.1-125, 7.3.0-233, 7.3.0-226, 7.2.1-32, 7.2.1-31, 7.2.0-401 Critical 9.8
• CVE-2017-4990 File upload in EMC Avamar Server Software 7.4.1-58, 7.4.0-242, 7.3.1-125, 7.3.0-233, 7.3.0-226 Critical 9.8
• CVE-2016-0903 Auth bypass in n/a Critical 9.1
• CVE-2013-3274 Missing authorization in n/a Critical 9.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8rc7-j85x-wm42.