CVE-2012-0518mediumunder attackCWE-601

CVE-2012-0518

Published · Updated

Follow this CVE+ Monitor Fusion Middleware

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 4.7epss 4.7%
from disclosure to weapon
Published on NVDOct 16
CISA KEV+3450d
Action required by CISAfederal deadline: 2022-04-18

Apply updates per vendor instructions.

In short

Oracle Application Server Single Sign-On has a flaw that allows attackers to redirect users to malicious websites, potentially tricking them into divulging sensitive information. This happens because the application doesn't properly validate where it sends users after login.

Technical detail

CWE-601 open redirect vulnerability in Oracle Fusion Middleware 10.1.4.3.0 Single Sign-On component allows unauthenticated remote attackers to manipulate redirect destinations during authentication flows, compromising user trust and enabling phishing attacks or credential harvesting through unvalidated URL parameters.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-3175.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Affected products
n/a · n/a