What is CVE-2012-2531?

CVE-2012-2531 is a vulnerability in Microsoft Windows 7, classified under Information Disclosure. Published 2012-11-14.

Is CVE-2012-2531 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Microsoft Windows 7

CVE-2012-2531

Microsoft Internet Information Services (IIS) 7.5 uses weak permissions for the Operational log, which allows local users to discover credentials by reading this file, aka "Password Disclosure Vulnerability."

Vulnerability class: Information Disclosure

EPSS: 0.009 (57.4th percentile) — read the EPSS interpretation.

Affected products

Weakness classification (CWE)

CWE-200 — Information Disclosure

Public proof-of-concept exploits

References

secure@microsoft.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
secure@microsoft.com (signature, x_refsource_OVAL, vdb-entry)
secure@microsoft.com (x_refsource_MS, vendor-advisory)

Frequently asked questions

What is CVE-2012-2531?: CVE-2012-2531 is a vulnerability in Microsoft Windows 7, classified under Information Disclosure. Published 2012-11-14.
Is CVE-2012-2531 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.