CVE-2013-3132

2013-07-1003:46:10

CWE-94

[email protected]

web.nvd.nist.gov

microsoft

.net framework

security

vulnerability

reflection

permissions

code execution

cve-2013-3132

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.6 High

AI Score

Confidence

Low

0.379 Low

EPSS

Percentile

97.2%

JSON

Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka “Delegate Reflection Bypass Vulnerability.”

Affected configurations

NVD

Node

microsoft.net_frameworkMatch1.0sp3

microsoft.net_frameworkMatch1.1sp1

microsoft.net_frameworkMatch2.0sp2

microsoft.net_frameworkMatch3.5

microsoft.net_frameworkMatch3.5.1

microsoft.net_frameworkMatch4.0

microsoft.net_frameworkMatch4.5

CPENameOperatorVersion
microsoft:.net_frameworkmicrosoft .net frameworkeq1.0
microsoft:.net_frameworkmicrosoft .net frameworkeq1.1
microsoft:.net_frameworkmicrosoft .net frameworkeq2.0
microsoft:.net_frameworkmicrosoft .net frameworkeq3.5
microsoft:.net_frameworkmicrosoft .net frameworkeq3.5.1
microsoft:.net_frameworkmicrosoft .net frameworkeq4.0
microsoft:.net_frameworkmicrosoft .net frameworkeq4.5

CPE	Name	Operator	Version
microsoft:.net_framework	microsoft .net framework	eq	1.0
microsoft:.net_framework	microsoft .net framework	eq	1.1
microsoft:.net_framework	microsoft .net framework	eq	2.0
microsoft:.net_framework	microsoft .net framework	eq	3.5
microsoft:.net_framework	microsoft .net framework	eq	3.5.1
microsoft:.net_framework	microsoft .net framework	eq	4.0
microsoft:.net_framework	microsoft .net framework	eq	4.5