CVE-2013-0004 — Improper Input Validation in Microsoft NET Framework

CWE-20 — Improper Input Validation6 documents4 sources
Severity
9.3CRITICALNVD
EPSS
8.7%
top 7.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Microsoft NET Framework
Timeline
PublishedJan 9
Latest updateMay 5

Description

Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate the permissions of objects in memory, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Double Construction Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages1 packages

▶NVDmicrosoft/net_framework7 versions+6

🔴Vulnerability Details

2
GHSA
GHSA-cq62-c6vp-pfrh: Microsoft↗2022-05-05
▶
CVEList
CVE-2013-0004: Microsoft↗2013-01-09
▶

💬Community

1
Bugzilla
CVE-2012-6100 moodle: Information leak through activity report (MSA-13-0004)↗2013-01-22
▶
CVE-2013-0004 — Improper Input Validation in Microsoft | cvebase