CVE-2014-4121
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly parse internationalized resource identifiers, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 19.2%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly parse internationalized resource identifiers, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted request to a .NET web application, aka ".NET Framework Remote Code Execution Vulnerability."
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 19.23% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-399
- Affected
- microsoft/.net framework
- Source
- secure@microsoft.com
References
- http://secunia.com/advisories/60969
- http://www.securityfocus.com/bid/70351
- http://www.securitytracker.com/id/1031021
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-057
- http://secunia.com/advisories/60969
- http://www.securityfocus.com/bid/70351
- http://www.securitytracker.com/id/1031021
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-057
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.