CVE-2012-4776

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 24.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-11-14 · updated 2026-06-16
Weakness: CWE-20

Description

The Web Proxy Auto-Discovery (WPAD) functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not validate configuration data that is returned during acquisition of proxy settings, which allows remote attackers to execute arbitrary JavaScript code by providing crafted data during execution of (1) an XAML browser application (aka XBAP) or (2) a .NET Framework application, aka "Web Proxy Auto-Discovery Vulnerability."

Affected products

Microsoft .NET Framework: 2.0-sp2, 3.5.1, 4.0, 3.5, 4.5

References

http://osvdb.org/87266
http://secunia.com/advisories/51236
http://www.securityfocus.com/bid/56463
http://www.securitytracker.com/id?1027753
http://www.us-cert.gov/cas/techalerts/TA12-318A.html
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-074
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15810
http://osvdb.org/87266
http://secunia.com/advisories/51236
http://www.securityfocus.com/bid/56463
http://www.securitytracker.com/id?1027753
http://www.us-cert.gov/cas/techalerts/TA12-318A.html

Get alerted when CVE-2012-4776 or the next vulnerability affects your stack