« Volver al listado

CVE-2013-3132

Estado: ModificadaAlta (9.3)—

Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Delegate Reflection Bypass Vulnerability."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microsoft — .net Framework

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-3132",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-07-10T03:46:10.077",
  "references": [
    {
      "url": "http://www.us-cert.gov/ncas/alerts/TA13-190A",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-052",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17430",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.us-cert.gov/ncas/alerts/TA13-190A",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-052",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17430",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka \"Delegate Reflection Bypass Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, y 4.5, no valida adecuadamente los permisos de los objetos que usan el reflejo (reflection), lo que permite a atacantes remotos ejecutar código de su elección a través de (1) una aplicación manipulada para navegadores XAML (XBAP) o (2)una aplicación .NET Framework. Aka \"Delegate Reflection Bypass Vulnerability.\""
    }
  ],
  "lastModified": "2026-06-16T23:54:34.667",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:.net_framework:1.0:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4B659D4-6EDD-4A31-A7CC-70B12EBEB4D8"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0BF6AE15-EAC3-4100-A742-211026C79CCC"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42A6DF09-B8E1-414D-97E7-453566055279"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E039CE1F-B988-4741-AE2E-5B36E2AF9688"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8EDC4407-7E92-4E60-82F0-0C87D1860D3A"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:.net_framework:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "792B417F-96A0-4E9D-9E79-5D7F982E2225"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:.net_framework:4.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "61FAD9EE-FA7F-4B39-8A9B-AFFAEC8BF214"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}