$ cve CVE-2007-0042 JSON

CVE-2007-0042 EXPLOIT

7.8

HIGH · CVSS 2.0 · EPSS 76.2% (pctl 100)

Patch early

A public exploit exists.

Description

Interpretation conflict in ASP.NET in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to access configuration files and obtain sensitive information, and possibly bypass security mechanisms that try to constrain the final substring of a string, via %00 characters, related to use of %00 as a string terminator within POSIX functions but a data character within .NET strings, aka "Null Byte Termination Vulnerability."

Scoring

CVSS	7.8 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:C/I:N/A:N
EPSS	76.15% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-200
On CISA KEV	no
Public exploit	yes
Published	2007-07-10
Last modified	2026-06-16

Affected (5)

Vendor	Product
microsoft	.net framework
microsoft	windows 2000
microsoft	windows 2003 server
microsoft	windows vista
microsoft	windows xp

Public exploits

Source	Title	Date
exploit-db	Microsoft .Net Framework 2.0 - Multiple Null Byte Injection Vulnerabilities	2007-07-06

References

→ the Explorer · watch your stack · NVD