CVEvulnerability
CVE-2013-1337
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2013-05-15
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-287
Description
Microsoft .NET Framework 4.5 does not properly create policy requirements for custom Windows Communication Foundation (WCF) endpoint authentication in certain situations involving passwords over HTTPS, which allows remote attackers to bypass authentication by sending queries to an endpoint, aka "Authentication Bypass Vulnerability."
Affected configurations
• microsoft .net framework 4.5
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://www.us-cert.gov/ncas/alerts/TA13-134A Third Party Advisory, US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-040 docs.microsoft.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16741 oval.cisecurity.org
- http://www.us-cert.gov/ncas/alerts/TA13-134A Third Party Advisory, US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-040 docs.microsoft.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16741 oval.cisecurity.org