by Kastro
Paper/Archive/CVE-2012-3152

CVE-2012-3152

Oracle Fusion Middleware — Oracle Fusion Middleware Unspecified Vulnerability

KEV · due 3 MayEPSS 99%public exploitSSVC actCVSS 9.1
critical.is priorityof 100
97
CVSS 9.1 (ADP)9.1 / 10 × 3027.3In CISA KEV+3030.0EPSS percentile 99.9.999 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the URLPARAMETER functionality allows remote attackers to read and upload arbitrary files to reports/rwservlet, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3153 to execute arbitrary code by uploading a .jsp file.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refblog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11gexploitexploit-db.com/exploits/31253refosvdb.org/86394refsecurityfocus.com/bid/55955refosvdb.org/86395refyoutube.com/watch?v=NinvMDOj7sMrefseclists.org/fulldisclosure/2014/Jan/186reforacle.com/technetwork/topics/security/cpuoct2012-1515893.htmlrefexchange.xforce.ibmcloud.com/vulnerabilities/79295refblog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153advisorymandriva.com/security/advisories?name=MDVSA-2013:150refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-3152kevcisa.gov/known-exploited-vulnerabilities-catalog