CVE-2014-4121

2014-10-1510:55:07

CWE-399

[email protected]

web.nvd.nist.gov

149

cve-2014-4121

.net framework

remote code execution

vulnerability

microsoft

nvd

memory corruption

denial of service

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

8.3 High

AI Score

Confidence

High

0.926 High

EPSS

Percentile

99.0%

JSON

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly parse internationalized resource identifiers, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted request to a .NET web application, aka “.NET Framework Remote Code Execution Vulnerability.”

Affected configurations

NVD

Node

microsoft.net_frameworkMatch2.0sp2

microsoft.net_frameworkMatch3.5

microsoft.net_frameworkMatch3.5.1

microsoft.net_frameworkMatch4.0

microsoft.net_frameworkMatch4.5

microsoft.net_frameworkMatch4.5.1

microsoft.net_frameworkMatch4.5.2

CPENameOperatorVersion
microsoft:.net_frameworkmicrosoft .net frameworkeq2.0
microsoft:.net_frameworkmicrosoft .net frameworkeq3.5
microsoft:.net_frameworkmicrosoft .net frameworkeq3.5.1
microsoft:.net_frameworkmicrosoft .net frameworkeq4.0
microsoft:.net_frameworkmicrosoft .net frameworkeq4.5
microsoft:.net_frameworkmicrosoft .net frameworkeq4.5.1
microsoft:.net_frameworkmicrosoft .net frameworkeq4.5.2

CPE	Name	Operator	Version
microsoft:.net_framework	microsoft .net framework	eq	2.0
microsoft:.net_framework	microsoft .net framework	eq	3.5
microsoft:.net_framework	microsoft .net framework	eq	3.5.1
microsoft:.net_framework	microsoft .net framework	eq	4.0
microsoft:.net_framework	microsoft .net framework	eq	4.5
microsoft:.net_framework	microsoft .net framework	eq	4.5.1
microsoft:.net_framework	microsoft .net framework	eq	4.5.2