CVE-2012-3152criticalunder attack

CVE-2012-3152

Published 16 Oct 2012 · Updated 22 Oct 2025

Follow this CVE + Monitor Fusion Middleware

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.1epss 99%

from disclosure to weapon469 days

Published on NVDOct 16

1st PoC+469d

metasploit+456d

CISA KEV+3305d

Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

A flaw in Oracle Reports Developer allows remote attackers to read and upload arbitrary files without proper authentication, potentially exposing sensitive data or enabling further attacks through malicious file uploads.

Technical detail

An unauthenticated remote vulnerability in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 exploits improper input validation in the URLPARAMETER functionality of the Report Server Component, permitting arbitrary file read/write operations via the reports/rwservlet endpoint. This can be chained with CVE-2012-3153 to achieve remote code execution by uploading JSP files.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the URLPARAMETER functionality allows remote attackers to read and upload arbitrary files to reports/rwservlet, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3153 to execute arbitrary code by uploading a .jsp file.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

n/a · n/a

public PoCs found — 6✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/31737 exploitdbwww.exploit-db.com/exploits/31253unverified githubgithub.com/abq0/rwsploit★ 6 vulncheckvulncheck.com/xdb/5a65658eed42unverified cve_referencewww.exploit-db.com/exploits/31253unverified vulncheckvulncheck.com/xdb/a9c7f157e132unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153/http://blog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11g/http://seclists.org/fulldisclosure/2014/Jan/186 https://exchange.xforce.ibmcloud.com/vulnerabilities/79295 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-3152 http://www.exploit-db.com/exploits/31253 http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html http://www.osvdb.org/86394 http://www.osvdb.org/86395 http://www.securityfocus.com/bid/55955 http://www.youtube.com/watch?v=NinvMDOj7sM