{"id":"CVE-2012-3152","published":"2012-10-16T23:55:03Z","modified":"2026-06-16T23:42:40Z","title":"Oracle Fusion Middleware Unspecified Vulnerability","vendor":"Oracle","product":"Fusion Middleware","tier":"core","eol":null,"description":{"text":"Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component.  NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the URLPARAMETER functionality allows remote attackers to read and upload arbitrary files to reports/rwservlet, and that this issue occurs in earlier versions.  NOTE: this can be leveraged with CVE-2012-3153 to execute arbitrary code by uploading a .jsp file.","provenance":"source","from":"NVD"},"summary":{"text":"An unspecified flaw in the Oracle Reports Developer component of Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 affects the Report Server Component. A remote, unauthenticated attacker with no user interaction can compromise confidentiality and integrity through unknown vectors, and reportedly through the URLPARAMETER functionality in reports/rwservlet to read and upload arbitrary files.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:06Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.98793,"percentile":0.99926,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2012-3152","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-01-01","exploitedFirstSeen":"2021-01-01","ransomware":false,"evidence":[{"url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf","date":"2021-01-01"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://www.greynoise.io/blog/coordinated-cloud-based-scanning-operation-targets-75-known-exposure-points","date":"2025-05-27"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153/","tags":["Broken Link"]},{"url":"http://blog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11g/","tags":["Broken Link"]},{"url":"http://seclists.org/fulldisclosure/2014/Jan/186","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.exploit-db.com/exploits/31253","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150","tags":["Broken Link"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html","tags":["Patch","Vendor Advisory"]},{"url":"http://www.osvdb.org/86394","tags":["Broken Link"]},{"url":"http://www.osvdb.org/86395","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/bid/55955","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.youtube.com/watch?v=NinvMDOj7sM","tags":["Exploit"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/79295","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153/","tags":["Broken Link"]},{"url":"http://blog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11g/","tags":["Broken Link"]},{"url":"http://seclists.org/fulldisclosure/2014/Jan/186","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.exploit-db.com/exploits/31253","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150","tags":["Broken Link"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html","tags":["Patch","Vendor Advisory"]},{"url":"http://www.osvdb.org/86394","tags":["Broken Link"]},{"url":"http://www.osvdb.org/86395","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/bid/55955","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.youtube.com/watch?v=NinvMDOj7sM","tags":["Exploit"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/79295","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-3152","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: remote unauthenticated attack against public-facing web component","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to affect confidentiality and integrity via unknown vectors","start":129,"end":212}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary file read from local system","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote attackers to read and upload arbitrary files to reports/rwservlet","start":411,"end":490}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-f4c4ebd4090daa7d77ab","title":"____________________________________________________________________________________________________","publisher":"clearskysec.com","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf","date":null,"mentions":[{"quote":"Server CVE-2019-3396\r\nTactic: Initial Access\r\nID: TA0001\r\nTechnique: Exploit Public-Facing\r\nApplication\r\nID: T1190\r\nTactic: Collection\r\nID: TA0009\r\nTechnique: Data from Information\r\nRepositories: Confluence\r\nID: T1213.001\r\n-\r\nAtlassian Jira Server\r\nor Data Center\r\nCVE-2019-11581\r\n-\r\nOracle 10g 11.1.2.0\r\nCVE-2012-3152","start":15714,"end":16032},{"quote":"• Oracle 10g 11.1.2.0 (CVE-2012-3152)","start":18546,"end":18583}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2012-3130","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2012-3130","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":31253,"url":"https://www.exploit-db.com/exploits/31253","title":"Oracle Forms and Reports 11.1 - Arbitrary Code Execution","type":"remote","platform":"jsp","date":"2014-01-29","verified":false,"provenance":"source"},{"id":31737,"url":"https://www.exploit-db.com/exploits/31737","title":"Oracle Forms and Reports - Remote Code Execution (Metasploit)","type":"remote","platform":"windows","date":"2014-02-18","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2014-01-29"},"pocGithub":{"count":1,"skipped":0,"earliest":"2026-05-15","earliestUrl":"https://github.com/abq0/rwsploit","repos":[{"name":"abq0/rwsploit","url":"https://github.com/abq0/rwsploit","stars":6,"created":"2026-05-15"}]},"metasploit":[{"name":"Oracle Forms and Reports Remote Code Execution","module":"exploit/multi/http/oracle_reports_rce","type":"exploit","disclosureDate":"2014-01-15","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/oracle_reports_rce.rb"}],"first":{"date":"2014-01-15","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/oracle_reports_rce.rb"},"provenance":"source"},"exploitRefs":["http://www.exploit-db.com/exploits/31253","http://www.youtube.com/watch?v=NinvMDOj7sM"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2012-10-16","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3152","provenance":"source"},{"date":"2014-01-15","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2014-01-29, PoC-in-GitHub 2026-05-15","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/oracle_reports_rce.rb","provenance":"source"},{"date":"2021-01-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2012-3130","provenance":"source"}],"speed":{"daysToPublicExploit":456,"firstExploitFrom":"Metasploit","daysToKev":3305},"priority":{"score":73.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2127 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9993"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 2 Exploit-DB entries; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}