What’s Vulnerable › Vulnerabilities

CVE-2013-3133

• Severity: critical (CVSS 9.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 20.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2013-07-10 · updated 2026-06-16
• Weakness: CWE-94

Description

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Anonymous Method Injection Vulnerability."

Affected products

• Microsoft .NET Framework: 2.0-sp2, 3.5, 3.5.1, 4.0, 4.5

References

• http://www.us-cert.gov/ncas/alerts/TA13-190A
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-052
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17421
• http://www.us-cert.gov/ncas/alerts/TA13-190A
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-052
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17421

Get alerted when CVE-2013-3133 or the next vulnerability affects your stack