« Volver al listado

CVE-2012-2611

Estado: ModificadaAlta (9.3)—💥 Exploit

La función DiagTraceR3Info en el procesador Dialog en disp+work.exe v7010.29.15.58313 y v7200.70.18.23869 en el Dispatcher en SAP NetWeaver v7.0 EHP1 y EHP2, cuando está activada una configuración concreta de Developer Trace, permite a atacantes remotos ejecutar código a través de un paquete SAP Diag manipulado.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

SAP — Netweaver

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-2611",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-05-15T04:21:43.547",
  "references": [
    {
      "url": "http://scn.sap.com/docs/DOC-8218",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id?1027052",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://service.sap.com/sap/support/notes/1687910",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://scn.sap.com/docs/DOC-8218",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1027052",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://service.sap.com/sap/support/notes/1687910",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The DiagTraceR3Info function in the Dialog processor in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2, when a certain Developer Trace configuration is enabled, allows remote attackers to execute arbitrary code via a crafted SAP Diag packet."
    },
    {
      "lang": "es",
      "value": "La función DiagTraceR3Info en el procesador  Dialog en disp+work.exe v7010.29.15.58313 y  v7200.70.18.23869 en el Dispatcher en SAP NetWeaver v7.0 EHP1 y EHP2, cuando está activada una configuración concreta de Developer Trace, permite a atacantes remotos ejecutar código a través de un paquete SAP Diag manipulado."
    }
  ],
  "lastModified": "2026-06-16T23:41:45.630",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:netweaver:7.0:ehp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FC1767F-10BD-468B-8D2B-538C82EB69B2"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:7.0:ehp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D04DC424-129B-448D-994B-7AC5D9B64703"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}