CVE-2012-5088

Estado: ModificadaAlta (10)—Exploit

Gravedad10Alta · CVSS 2.0

Probabilidad de explotación79 %mayor que el 100 % de las CVE

Explotación activaNono figura en el catálogo de CISA

Exploit públicoDisponiblePublicado en Exploit-DB · Módulo de Metasploit (exploit fiable y al alcance de cualquiera)

Una vulnerabilidad no especificada en el componente Java Runtime Environment (JRE) en Oracle Java SE 7 Update v7 y anteriores permite a atacantes remotos afectar la confidencialidad, integridad y disponibilidad a través de vectores desconocidos relacionados con las bibliotecas.

CVSS

Puntuación base: 10
Versión: 2.0
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 79 %
Percentil entre todas las CVEs puntuadas: 100
Fecha de la puntuación: 21/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Módulo de Metasploit (exploit fiable y al alcance de cualquiera) · Java Applet Method Handle Remote Code Execution
Publicado en Exploit-DB · Java Applet - Method Handle Remote Code Execution (Metasploit) (24/1/2013)

Tecnologías afectadas (2)

Oracle — JDK Oracle — JRE

CWE

NVD-CWE-noinfo

Referencias

Mostrar las 20 referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2012-5088",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert_us@oracle.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-10-16T21:55:02.540",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2012-1386.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2012-1391.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2012-1467.html",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://secunia.com/advisories/51029",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://secunia.com/advisories/51326",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://secunia.com/advisories/51390",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79420",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16605",
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2012-1386.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2012-1391.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2012-1467.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/51029",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/51326",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/51390",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79420",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16605",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad no especificada en el componente Java Runtime Environment (JRE) en Oracle Java SE 7 Update v7 y anteriores permite a atacantes remotos afectar la confidencialidad, integridad y disponibilidad a través de vectores desconocidos relacionados con las bibliotecas.\r\n"
    }
  ],
  "lastModified": "2026-06-16T23:46:13.103",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jre:*:update7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9DC59C00-DFD8-404D-82C6-751C470D7B66",
              "versionEndIncluding": "1.7.0"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C27372B-A091-46D5-AE39-A44BBB1D9EE2"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4B153FD-E20B-4909-8B10-884E48F5B590"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB106FA9-26CE-48C5-AEA5-FD1A5454AEE2"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5831D70B-3854-4CB8-B88D-40F1743DAEE0"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EEB101C9-CA38-4421-BC0C-C1AD47AA2CC9"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA302DF3-ABBB-4262-B206-4C0F7B5B1E91"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F9A8EBCB-5E6A-42F0-8D07-F3A3D1C850F0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:*:update7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ADD9674C-3207-4D8D-A9C3-2EA53E33532B",
              "versionEndIncluding": "1.7.0"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E44FC8AF-F76F-4A8E-8D03-4F8BCA8CB031"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6152036D-6421-4AE4-9223-766FE07B5A44"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D375CECB-405C-4E18-A7E8-9C5A2F97BD69"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52EEEA5A-E77C-43CF-A063-9D5C64EA1870"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "003746F6-DEF0-4D0F-AD97-9E335868E301"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CF830E0E-0169-4B6A-81FF-2E9FCD7D913B"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6BAE3670-0938-480A-8472-DFF0B3A0D0BF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorImpact": "Per: http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html\r\n\r\n\"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)\"",
  "sourceIdentifier": "secalert_us@oracle.com"
}