CVE-2012-4776: Input Validation
The Web Proxy Auto-Discovery (WPAD) functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not validate configuration data that is returned during acquisition of proxy settings, which allows remote attackers to execute arbitrary JavaScript code by providing crafted data during execution of (1) an XAML browser application (aka XBAP) or (2) a .NET Framework application, aka "Web Proxy Auto-Discovery Vulnerability."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4776?
CVE-2012-4776 is classified as a critical vulnerability that could allow remote attackers to execute arbitrary JavaScript code.
How do I fix CVE-2012-4776?
To fix CVE-2012-4776, ensure that you apply the latest updates and patches from Microsoft for the affected .NET Framework versions.
What systems are vulnerable to CVE-2012-4776?
CVE-2012-4776 affects Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 running on various Windows systems.
What kind of attack can exploit CVE-2012-4776?
CVE-2012-4776 can be exploited by attackers providing crafted data during the acquisition of proxy settings, leading to arbitrary code execution.
Is CVE-2012-4776 targeted towards specific applications?
CVE-2012-4776 specifically targets applications that utilize the Web Proxy Auto-Discovery (WPAD) feature within the affected .NET Framework versions.