VULNERABILITY INTELLIGENCE

CVE-2013-0004

CVSS score9.3 HIGH
EPSS probability21.42%
CISA KEVNot currently listed
Published2013-01-09
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:C/I:C/A:C

Description

Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate the permissions of objects in memory, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Double Construction Vulnerability."

Weakness classification

  • CWE-20: Improper Input Validation

Primary references