CVE-2013-3860

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly parse a DTD during XML digital-signature validation, which allows remote…

published October 9, 2013

CVSS

—

EPSS

31%

Percentile

98.2

In the wild

Unconfirmed

What it is

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly parse a DTD during XML digital-signature validation, which allows remote attackers to cause a denial of service (application crash or hang) via a crafted signed XML document, aka "Entity Expansion Vulnerability."

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.30612 · 98.2th percentile
Published: 2013-10-09T14:44Z

EPSS history

Timeline

09 OCT 14:44Z
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly parse a DTD during XML digital-signature validation, which allows remote…
cvelistv5