CVE-2014-4149 — Improper Input Validation in Microsoft NET Framework

CWE-20 — Improper Input Validation5 documents5 sources
Severity
9.3CRITICALNVD
EPSS
37.7%
top 2.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Microsoft NET Framework
Timeline
PublishedNov 11
Latest updateMay 14

Description

Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly perform TypeFilterLevel checks, which allows remote attackers to execute arbitrary code via crafted data to a .NET Remoting endpoint, aka "TypeFilterLevel Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages1 packages

▶NVDmicrosoft/net_framework8 versions+7

🔴Vulnerability Details

3
GHSA
GHSA-rrc4-8xgr-jpcc: Microsoft↗2022-05-14
▶
CVEList
CVE-2014-4149: Microsoft↗2014-11-11
▶
OSV
qemu, qemu-kvm vulnerabilities↗2014-09-08
▶

💥Exploits & PoCs

1
Exploit-DB
.NET Remoting Services - Remote Command Execution↗2014-11-17
▶
CVE-2014-4149 — Improper Input Validation in Microsoft | cvebase