CVE-2013-3171

Опубликовано: 10 июл. 2013

Источник: nvd

CVSS2: 9.3

EPSS Низкий

Описание

The serialization functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly check the permissions of delegate objects, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages a partial-trust relationship, aka "Delegate Serialization Vulnerability."

Ссылки

http://www.us-cert.gov/ncas/alerts/TA13-190A
Third Party Advisory
US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-052
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16867
http://www.us-cert.gov/ncas/alerts/TA13-190A
Third Party Advisory
US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-052
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16867

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*

cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*

cpe:2.3:a:microsoft:.net_framework:3.5:sp1:*:*:*:*:*:*

cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*

cpe:2.3:a:microsoft:.net_framework:4.0:*:*:*:*:*:*:*

cpe:2.3:a:microsoft:.net_framework:4.5:*:*:*:*:*:*:*

EPSS

Процентиль: 92%

0.0861

Низкий

9.3 Critical

CVSS2

Дефекты

CWE-94

Связанные уязвимости

GHSA-x6g8-r436-7qmg

github

больше 3 лет назад