(MS13-103) Vulnerability in ASP.NET SignalR Could Allow Elevation of Privilege (2905244)

• Email
• Facebook
• 
  Twitter
• Google+
• Linkedin

  Severity: HIGH

  CVE Identifier: CVE-2013-5042

  Advisory Date: DEC 26, 2013

---

  DESCRIPTION

This security update resolves a privately reported vulnerability in ASP.NET SignalR. The vulnerability could allow elevation of privilege if an attacker reflects specially crafted JavaScript back to the browser of a targeted user.

  SOLUTION

  PATCH: https://technet.microsoft.com/en-us/security/bulletin/ms13-103

  AFFECTED SOFTWARE AND VERSION

• Microsoft Visual Studio Team Foundation Server 2013
• ASP.NET SignalR 2.0.x
• ASP.NET SignalR 1.1.x

Related Vulnerability

• December 2013 - Microsoft Releases 11 Security Advisories