CVE-2012-4776

Published: Nov 14, 2012Modified: Apr 29, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

The Web Proxy Auto-Discovery (WPAD) functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not validate configuration data that is returned during acquisition of proxy settings, which allows remote attackers to execute arbitrary JavaScript code by providing crafted data during execution of (1) an XAML browser application (aka XBAP) or (2) a .NET Framework application, aka "Web Proxy Auto-Discovery Vulnerability."

Affected (5)

Products: Microsoft: .net Framework

Microsoft

1 product

.net Framework

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 2.0 sp2

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 3.5.1

Configuration C

1 vulnerable · 8 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 4.0

Running on/with	Platform Versions
Microsoft Windows 7	All versions
Microsoft Windows 7	All versions
Microsoft Windows Server 2003	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Xp	All versions
Microsoft Windows Xp	All versions

Configuration D

1 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 3.5

Running on/with	Platform Versions
Microsoft Windows 8	All versions
Microsoft Windows 8	All versions
Microsoft Windows Server 2012	All versions

Configuration E

1 vulnerable · 5 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 4.5

Running on/with	Platform Versions
Microsoft Windows 7	All versions
Microsoft Windows 7	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Vista	All versions