CVE-2012-2532

medium · 5

Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) processes unspecified commands before TLS is enabled for a session, which allows remote attackers to obtain sensitive information by reading the replies to these commands, aka "FTP Command Injection Vulnerability."

CVSS

42.0%

EPSS (exploit prob.)

99th

EPSS percentile

2012-11-14

Published

AV:N/AC:L/Au:N/C:P/I:N/A:N

Weaknesses

CWE-200

Affected products

Vendor	Product	Affected versions
microsoft	ftp_service	7.0
microsoft	windows_server_2008	all versions
microsoft	windows_server_2008	all versions
microsoft	windows_vista	all versions
microsoft	windows_vista	all versions
microsoft	ftp_service	7.5
microsoft	windows_7	all versions
microsoft	windows_7	all versions
microsoft	windows_7	all versions
microsoft	windows_7	all versions
microsoft	windows_server_2008	all versions
microsoft	windows_server_2008	all versions
microsoft	windows_server_2008	r2
microsoft	windows_server_2008	r2
microsoft	windows_server_2008	r2
microsoft	windows_server_2008	r2
microsoft	windows_vista	all versions
microsoft	windows_vista	all versions
microsoft	windows_7	all versions
microsoft	windows_7	all versions
microsoft	windows_7	all versions
microsoft	windows_7	all versions
microsoft	windows_server_2008	r2
microsoft	windows_server_2008	r2
microsoft	windows_server_2008	r2
microsoft	windows_server_2008	r2

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2012-2532