CVE-2014-4149
high · 9.3Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly perform TypeFilterLevel checks, which allows remote attackers to execute arbitrary code via crafted data to a .NET Remoting endpoint, aka "TypeFilterLevel Vulnerability."
9.3
CVSS
21.4%
EPSS (exploit prob.)
97th
EPSS percentile
2014-11-11
Published
AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-20
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | .net_framework | 1.1 |
| microsoft | .net_framework | 2.0 |
| microsoft | .net_framework | 3.5 |
| microsoft | .net_framework | 3.5.1 |
| microsoft | .net_framework | 4.0 |
| microsoft | .net_framework | 4.5 |
| microsoft | .net_framework | 4.5.1 |
| microsoft | .net_framework | 4.5.2 |
Check a specific version with /api/v1/cve/match.
References
- http://blogs.technet.com/b/srd/archive/2014/11/11/ms14-072-net-remoting-elevation-of-privilege-vulnerability.aspx
- http://www.securitytracker.com/id/1031188
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-072
- http://blogs.technet.com/b/srd/archive/2014/11/11/ms14-072-net-remoting-elevation-of-privilege-vulnerability.aspx
- http://www.securitytracker.com/id/1031188
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-072
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2014-4149