CVE-2012-4776 — Improper Input Validation in Microsoft NET Framework

CWE-20 — Improper Input Validation3 documents3 sources
Severity
9.3CRITICALNVD
EPSS
45.0%
top 2.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Microsoft NET Framework
Timeline
PublishedNov 14
Latest updateMay 13

Description

The Web Proxy Auto-Discovery (WPAD) functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not validate configuration data that is returned during acquisition of proxy settings, which allows remote attackers to execute arbitrary JavaScript code by providing crafted data during execution of (1) an XAML browser application (aka XBAP) or (2) a .NET Framework application, aka "Web Proxy Auto-Discovery Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages1 packages

▶NVDmicrosoft/net_framework5 versions+4

🔴Vulnerability Details

2
GHSA
GHSA-7962-fqpx-4h4f: The Web Proxy Auto-Discovery (WPAD) functionality in Microsoft↗2022-05-13
▶
CVEList
CVE-2012-4776: The Web Proxy Auto-Discovery (WPAD) functionality in Microsoft↗2012-11-14
▶
CVE-2012-4776 — Improper Input Validation in Microsoft | cvebase