Title

Microsoft .NET Framework Information Disclosure Vulnerability (MS16-091) (Cat II impact)

Discussion

Microsoft has released a security bulletin addressing a vulnerability in .NET Framework. To exploit the vulnerability, an attacker could create specially crafted XML data and induce an application to parse and validate the XML data. If successfully exploited, this vulnerability could allow an attacker to read arbitrary files via an XML external entity declaration.

Check Content

Fix Text

Additional Identifiers

Rule ID:

Vulnerability ID: V-70445

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.