Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2012-2611 — Improper Input Validation in SAP Netweaver

CWE-20 — Improper Input Validation6 documents4 sources
Severity
9.3CRITICALNVD
EPSS
77.7%
top 1.01%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
SAP Netweaver
Timeline
PublishedMay 15
Latest updateMay 17

Description

The DiagTraceR3Info function in the Dialog processor in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2, when a certain Developer Trace configuration is enabled, allows remote attackers to execute arbitrary code via a crafted SAP Diag packet.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages1 packages

▶NVDsap/netweaver7.0

🔴Vulnerability Details

2
GHSA
GHSA-654v-2cc9-6r92: The DiagTraceR3Info function in the Dialog processor in disp+work↗2022-05-17
▶
CVEList
CVE-2012-2611: The DiagTraceR3Info function in the Dialog processor in disp+work↗2012-05-15
▶

💥Exploits & PoCs

3
Exploit-DB
SAP NetWeaver Dispatcher - DiagTraceR3Info Buffer Overflow (Metasploit)↗2012-09-07
▶
Exploit-DB
SAP NetWeaver Dispatcher 7.0 ehp1/2 - Multiple Vulnerabilities↗2012-08-21
▶
Exploit-DB
SAP NetWeaver Dispatcher - Multiple Vulnerabilities↗2012-05-09
▶
CVE-2012-2611 — Improper Input Validation in SAP | cvebase