Oracle Fusion Middleware Unspecified Vulnerability

CRITICAL 9.1EXPLOITED (CISA KEV)CVE-2012-3152 · Published 16/10/2012 · updated 16/06/2026

Oracle Fusion Middleware Unspecified Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
fusion middleware oracle	`= 11.1.1.4.0= 11.1.1.6.0= 11.1.2.0`	No fix yet

Description

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the URLPARAMETER functionality allows remote attackers to read and upload arbitrary files to reports/rwservlet, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3153 to execute arbitrary code by uploading a .jsp file.

References

blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153 · Broken Link
blog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11g · Broken Link
seclists.org/fulldisclosure/2014/Jan/186 · Mailing List
exploit-db.com/exploits/31253 · Exploit
mandriva.com/security/advisories · Broken Link
oracle.com/technetwork/topics/security/cpuoct2012-1515893.html · Patch
osvdb.org/86394 · Broken Link
osvdb.org/86395 · Broken Link
securityfocus.com/bid/55955 · Broken Link
youtube.com/watch · Exploit
exchange.xforce.ibmcloud.com/vulnerabilities/79295 · Third Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2012-3152

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free