CVE-2013-0267

CVE-2013-0267 is a critical vulnerability affecting Apache VCL versions 2.3.x prior to 2.3.2, and 2.2.x prior to 2.2.2. It stems from improper data validation within the web GUI's Privileges section and the XMLRPC API. This flaw allows remote authenticated users with specific permissions (nodeAdmin, manageGroup, resourceGrant, or userGrant) to escalate privileges, trigger a denial of service, or execute cross-site scripting attacks. With a CVSS v3 score of 8.8 (High), the vulnerability is easily exploitable over the network with low attack complexity and requires only low privileges, potentially leading to high impact on confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.