9.3

CVE-2013-3132

Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Delegate Reflection Bypass Vulnerability."

Data is provided by the National Vulnerability Database (NVD)
Microsoft ≫ .Net Framework Version1.0 Updatesp3
Microsoft ≫ .Net Framework Version1.1 Updatesp1
Microsoft ≫ .Net Framework Version2.0 Updatesp2
Microsoft ≫ .Net Framework Version3.5
Microsoft ≫ .Net Framework Version3.5.1
Microsoft ≫ .Net Framework Version4.0
Microsoft ≫ .Net Framework Version4.5
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 4.34% 0.883
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://www.us-cert.gov/ncas/alerts/TA13-190A
Third Party Advisory
US Government Resource