CVEvulnerability
CVE-2014-4073
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2014-10-15
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-264
Description
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 processes unverified data during interaction with the ClickOnce installer, which allows remote attackers to gain privileges via vectors involving Internet Explorer, aka ".NET ClickOnce Elevation of Privilege Vulnerability."
Affected configurations
• microsoft .net framework 2.0
• microsoft .net framework 3.5
• microsoft .net framework 3.5.1
• microsoft .net framework 4.0
• microsoft .net framework 4.5
• microsoft .net framework 4.5.1
• microsoft .net framework 4.5.2
Related
Weakness · not in database (1)
References
- http://blogs.technet.com/b/srd/archive/2014/10/14/more-details-about-cve-2014-4073-elevation-of-privilege-vulnerability.aspx Vendor Advisory
- http://secunia.com/advisories/60969 secunia.com
- http://www.securityfocus.com/bid/70313 www.securityfocus.com
- http://www.securitytracker.com/id/1031021 www.securitytracker.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-057 docs.microsoft.com
- http://blogs.technet.com/b/srd/archive/2014/10/14/more-details-about-cve-2014-4073-elevation-of-privilege-vulnerability.aspx Vendor Advisory
- http://secunia.com/advisories/60969 secunia.com
- http://www.securityfocus.com/bid/70313 www.securityfocus.com
- http://www.securitytracker.com/id/1031021 www.securitytracker.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-057 docs.microsoft.com