CVE-2012-4776

EPSS 48.63%
Published 14.11.2012 00:55:01
Last modified 11.04.2025 00:51:21
Source secure@microsoft.com
Teams watchlist Login
Open Login

The Web Proxy Auto-Discovery (WPAD) functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not validate configuration data that is returned during acquisition of proxy settings, which allows remote attackers to execute arbitrary JavaScript code by providing crafted data during execution of (1) an XAML browser application (aka XBAP) or (2) a .NET Framework application, aka "Web Proxy Auto-Discovery Vulnerability."

Affected products Warnungen 0 Metrics 2 CWE 1 References 10

Data is provided by the National Vulnerability Database (NVD)

Microsoft ≫ .Net Framework Version2.0 Updatesp2

   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionitanium
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx64
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx86
   Microsoft ≫ Windows Vista Updatesp2
   Microsoft ≫ Windows Xp Updatesp3
   Microsoft ≫ Windows Xp Version- Updatesp2 Editionx64

Microsoft ≫ .Net Framework Version3.5.1

Microsoft ≫ .Net Framework Version4.0

   Microsoft ≫ Windows 7 Editionx64
   Microsoft ≫ Windows 7 Editionx86
   Microsoft ≫ Windows 7 Updatesp1 Editionx64
   Microsoft ≫ Windows 7 Updatesp1 Editionx86
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Server 2008 Updater2 Editionitanium
   Microsoft ≫ Windows Server 2008 Updater2 Editionx64
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionitanium
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx64
   Microsoft ≫ Windows Vista Updatesp2
   Microsoft ≫ Windows Xp Updatesp3
   Microsoft ≫ Windows Xp Version- Updatesp2 Editionx64

Microsoft ≫ .Net Framework Version3.5

   Microsoft ≫ Windows 8 Version- Update- Editionx64
   Microsoft ≫ Windows 8 Version- Update- Editionx86
   Microsoft ≫ Windows Server 2012 Version-

Microsoft ≫ .Net Framework Version4.5

   Microsoft ≫ Windows 7 Updatesp1 Editionx64
   Microsoft ≫ Windows 7 Updatesp1 Editionx86
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx64
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx86
   Microsoft ≫ Windows Vista Updatesp2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	48.63%	0.977

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.3	8.6	10	AV:N/AC:M/Au:N/C:C/I:C/A:C

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.us-cert.gov/cas/techalerts/TA12-318A.html

US Government Resource

http://secunia.com/advisories/51236

http://www.securitytracker.com/id?1027753

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-074

http://osvdb.org/87266

http://www.securityfocus.com/bid/56463

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15810

https://nvd.nist.gov/vuln/detail/CVE-2012-4776

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2012-4776

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2012-4776

EUVD