CVE-2007-0042: microsoft .net_framework
Vulnerability summary
CVE-2007-0042 is a high (CVSS 7.8) vulnerability in microsoft .net_framework. EPSS estimates a 76.15% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 10-07-2007PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Interpretation conflict in ASP.NET in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to access configuration files and obtain sensitive information, and possibly bypass security mechanisms that try to constrain the final substring of a string, via %00 characters, related to use of %00 as a string terminator within POSIX functions but a data character within .NET strings, aka "Null Byte Termination Vulnerability."
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
76.15%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 76.15% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundMicrosoft .Net Framework 2.0 - Multiple Null Byte Injection Vulnerabilities
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Microsoft1 product
- .net_framework1.0 | 1.1 | 2.0
1 vendor · 1 product
References
8 links
docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-040Vendor AdvisoryX Refsource MS- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2070VDB EntrySignatureX Refsource OVAL
- security-assessment.com/files/…X Refsource MISC
- www.us-cert.gov/cas/techalerts/TA07-191A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource