CVE-2013-3132 — Code Injection in Microsoft NET Framework

CWE-94 — Code Injection3 documents3 sources
Severity
9.3CRITICALNVD
EPSS
7.1%
top 8.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Microsoft NET Framework
Timeline
PublishedJul 10
Latest updateMay 14

Description

Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Delegate Reflection Bypass Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages1 packages

▶NVDmicrosoft/net_framework7 versions+6

🔴Vulnerability Details

2
GHSA
GHSA-qgp4-cv63-pvx3: Microsoft↗2022-05-14
▶
CVEList
CVE-2013-3132: Microsoft↗2013-07-10
▶
CVE-2013-3132 — Code Injection in Microsoft | cvebase