« Back to list

CVE-2010-1898

Status: ModifiedHigh (9.3)—

The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP1, 2.0 SP2, 3.5, 3.5 SP1, and 3.5.1, and Microsoft Silverlight 2 and 3 before 3.0.50611.0 on Windows and before 3.0.41130.0 on Mac OS X, does not properly handle interfaces and delegations to virtual methods, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka "Microsoft Silverlight and Microsoft .NET Framework CLR Virtual Method Delegate Vulnerability."

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (2)

Microsoft — .net FrameworkMicrosoft — Silverlight

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2010-1898",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-08-11T18:47:50.250",
  "references": [
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA10-222A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-060",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12033",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA10-222A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-060",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12033",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP1, 2.0 SP2, 3.5, 3.5 SP1, and 3.5.1, and Microsoft Silverlight 2 and 3 before 3.0.50611.0 on Windows and before 3.0.41130.0 on Mac OS X, does not properly handle interfaces and delegations to virtual methods, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka \"Microsoft Silverlight and Microsoft .NET Framework CLR Virtual Method Delegate Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "El Common Language Runtime (CLR) de Microsoft .NET Framework v2.0 SP1, v2.0 SP2, v3.5, v3.5 SP1, y v3.5.1, y Microsoft Silverlight v2 y v3 anterior a v3.0.50611.0 en Windows y anterior a v3.0.41130.0 on Mac OS X, no maneja decuadamente intefaces y delegaciones de métodos virtuales, lo que permite a atacantes remotos ejecutar código de su elección a través de (1) una aplicación de navegador XAML manipulada (también conocida como XBAP), (2) una aplicación ASP.NET manipulada, o (3) una aplicación .NET Framework manipulada. También conocido cómo Microsoft Silverlight and Microsoft .NET Framework CLR Virtual Method Delegate Vulnerability.\""
    }
  ],
  "lastModified": "2026-06-16T23:19:33.000",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:.net_framework:2.0:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F97EB992-2DC1-4E31-A298-072D8313130B"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42A6DF09-B8E1-414D-97E7-453566055279"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E039CE1F-B988-4741-AE2E-5B36E2AF9688"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:.net_framework:3.5:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C610747-93E5-4014-8ED2-47F333174832"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8EDC4407-7E92-4E60-82F0-0C87D1860D3A"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:silverlight:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "20B8341A-C2AC-4C81-A7E7-D79C8970027C",
              "versionEndIncluding": "3.0.40818.0"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:silverlight:2.0.31005.00:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A20AA4A5-B6DA-42F5-ADA6-CE8F3D08DAEB"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:silverlight:2.0.40115.00:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F90BA702-AEA8-4CFA-8FE7-85EC3C36C893"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:silverlight:3.0.40624.00:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D5F951F-6DCB-4651-A99A-C7237025E00C"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:silverlight:3.0.40723.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FAAF6291-8E80-4DE5-820C-BA9778822194"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "0FF5999A-9D12-4CDD-8DE9-A89C10B2D574"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:silverlight:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D084CE43-A992-456C-A431-5D14EE6AF430",
              "versionEndIncluding": "3.0.50106.0"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:silverlight:2.0.31005.00:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A20AA4A5-B6DA-42F5-ADA6-CE8F3D08DAEB"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:silverlight:2.0.40115.00:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F90BA702-AEA8-4CFA-8FE7-85EC3C36C893"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:silverlight:3.0.40624.00:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D5F951F-6DCB-4651-A99A-C7237025E00C"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:silverlight:3.0.40723.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FAAF6291-8E80-4DE5-820C-BA9778822194"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:silverlight:3.0.40818.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7AB865CD-A8EC-4341-9DF8-D4D92351EE1D"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2CF61F35-5905-4BA9-AD7E-7DB261D2F256"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}