CVE-2012-1895 : The reflection implementation in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4 does not properly enfo

The reflection implementation in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4 does not properly enforce object permissions, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka "Reflection Bypass Vulnerability."

Published 2012-11-14 00:55:01

Updated 2023-12-07 18:38:57

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Execute code

Exploit prediction scoring system (EPSS) score for CVE-2012-1895

EPSS FAQ

59.88%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 97 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2012-1895

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

References for CVE-2012-1895

Products affected by CVE-2012-1895

Microsoft » .net Framework » Version: 1.1 Update SP1
cpe:2.3:a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2003 » Update SP2
When used together with: Microsoft » Windows Server 2008 » Update SP2 Itanium Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X64 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X86 Edition
When used together with: Microsoft » Windows Vista » Update SP2
When used together with: Microsoft » Windows Xp » Update SP3
When used together with: Microsoft » Windows Xp » Version: N/A Update SP2 X64 Edition
Microsoft » .net Framework » Version: 1.0 Update SP3
cpe:2.3:a:microsoft:.net_framework:1.0:sp3:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Xp » Version: 2005 Update SP3 Media Center Edition
When used together with: Microsoft » Windows Xp » Version: 2005 Update SP3 Tablet Pc Edition
Microsoft » .net Framework » Version: 2.0 Update SP2
cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2003 » Update SP2
When used together with: Microsoft » Windows Server 2008 » Update SP2 Itanium Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X64 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X86 Edition
When used together with: Microsoft » Windows Vista » Update SP2
When used together with: Microsoft » Windows Xp » Update SP3
When used together with: Microsoft » Windows Xp » Version: N/A Update SP2 X64 Edition
Microsoft » .net Framework » Version: 3.5.1
cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 7 » X64 Edition
When used together with: Microsoft » Windows 7 » X86 Edition
When used together with: Microsoft » Windows 7 » Update SP1 X64 Edition
When used together with: Microsoft » Windows 7 » Update SP1 X86 Edition
When used together with: Microsoft » Windows Server 2008 » Update R2 Itanium Edition
When used together with: Microsoft » Windows Server 2008 » Update R2 X64 Edition
Microsoft » .net Framework » Version: 4.0
cpe:2.3:a:microsoft:.net_framework:4.0:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 7 » X64 Edition
When used together with: Microsoft » Windows 7 » X86 Edition
When used together with: Microsoft » Windows 7 » Update SP1 X64 Edition
When used together with: Microsoft » Windows 7 » Update SP1 X86 Edition
When used together with: Microsoft » Windows Server 2003 » Update SP2
When used together with: Microsoft » Windows Server 2008 » Update R2 Itanium Edition
When used together with: Microsoft » Windows Server 2008 » Update R2 X64 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 Itanium Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X64 Edition
When used together with: Microsoft » Windows Vista » Update SP2
When used together with: Microsoft » Windows Xp » Update SP3
When used together with: Microsoft » Windows Xp » Version: N/A Update SP2 X64 Edition

Vulnerability Details : CVE-2012-1895

Exploit prediction scoring system (EPSS) score for CVE-2012-1895

CVSS scores for CVE-2012-1895

CWE ids for CVE-2012-1895

References for CVE-2012-1895

Products affected by CVE-2012-1895