CVE-2012-3153
82Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actepss 98%
da publicação à arma469 dias
Publicada no NVD16 de out.
1ª PoC+469d
metasploit+456d
VulnCheck+4617d
probabilidade de exploração
98%top 1% das CVEs
exploração observada
simVulnCheck
5 exploit(s) público(s)
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the PARSEQUERY function allows remote attackers to obtain database credentials via reports/rwservlet/parsequery, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3152 to execute arbitrary code by uploading a .jsp file.
Produtos afetados
n/a · n/aPoCs públicas encontradas — 5
exploitdbwww.exploit-db.com/exploits/31253não verificadogithubgithub.com/Mekanismen/pwnacle-fusion★ 8cve_referencewww.exploit-db.com/exploits/31253não verificadovulncheckvulncheck.com/xdb/9b10640bb794não verificadovulncheckvulncheck.com/xdb/db0bdd40ee65não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
http://blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153/http://blog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11g/http://seclists.org/fulldisclosure/2014/Jan/186https://exchange.xforce.ibmcloud.com/vulnerabilities/79296http://www.exploit-db.com/exploits/31253http://www.mandriva.com/security/advisories?name=MDVSA-2013:150http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.htmlhttp://www.securityfocus.com/bid/55961