CVE-2013-1290
Microsoft SharePoint Server 2013, in certain configurations involving legacy My Sites, does not...
Microsoft SharePoint Server 2013, in certain configurations involving legacy My Sites, does not properly establish default access controls for a SharePoint list, which allows remote authenticated users to bypass intended restrictions on reading list items via a direct request for a list's location, aka "Incorrect Access Rights Information Disclosure Vulnerability."
Exploit likelihood
What each source reports
NVD Score used
Microsoft SharePoint Server 2013, in certain configurations involving legacy My Sites, does not properly establish default access controls for a SharePoint list, which allows remote authenticated users to bypass intended restrictions on reading list items via a direct request for a list's location, aka "Incorrect Access Rights Information Disclosure Vulnerability."
- Record
CVE-2013-1290- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Microsoft SharePoint Server 2013, in certain configurations involving legacy My Sites, does not properly establish default access controls for a SharePoint list, which allows remote authenticated users to bypass intended restrictions on reading list items via a direct request for a list's location, aka "Incorrect Access Rights Information Disclosure Vulnerability."
- Record
CVE-2013-1290- Updated
- 2026-11-02
EUVDEUVD-2013-1330 No score
Microsoft SharePoint Server 2013, in certain configurations involving legacy My Sites, does not properly establish default access controls for a SharePoint list, which allows remote authenticated users to bypass intended restrictions on reading list items via a direct request for a list's location, aka "Incorrect Access Rights Information Disclosure Vulnerability."
- Record
EUVD-2013-1330- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v7rc-wwx8-7hh9 No score
Microsoft SharePoint Server 2013, in certain configurations involving legacy My Sites, does not...
Microsoft SharePoint Server 2013, in certain configurations involving legacy My Sites, does not properly establish default access controls for a SharePoint list, which allows remote authenticated users to bypass intended restrictions on reading list items via a direct request for a list's location, aka "Incorrect Access Rights Information Disclosure Vulnerability."
- Record
GHSA-v7rc-wwx8-7hh9- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1290 is a low vulnerability (CVSS 3.5) in Microsoft Sharepoint Server, published April 9, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 17.0%, the 97th percentile. No source names a fixed version.