CVE-2014-4073 — Microsoft NET Framework vulnerability

CWE-2645 documents5 sources
Severity
10.0CRITICALNVD
EPSS
30.1%
top 3.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Microsoft NET Framework
Timeline
PublishedOct 15
Latest updateMay 14

Description

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 processes unverified data during interaction with the ClickOnce installer, which allows remote attackers to gain privileges via vectors involving Internet Explorer, aka ".NET ClickOnce Elevation of Privilege Vulnerability."

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages1 packages

▶NVDmicrosoft/net_framework7 versions+6

🔴Vulnerability Details

3
GHSA
GHSA-h6h5-h2pp-h9f3: Microsoft↗2022-05-14
▶
Project0
Exploiting .NET Managed DCOM - Project Zero↗2017-04-01
▶
CVEList
CVE-2014-4073: Microsoft↗2014-10-15
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Windows - ManagementObject Arbitrary .NET Serialization Remote Code Execution↗2017-04-20
▶
CVE-2014-4073 — Microsoft NET Framework vulnerability | cvebase