Oracle Fusion Middleware Unspecified
CVE-2012-3152 is a critical-severity vulnerability in Fusion Middleware from Oracle, with a CVSS 3.1 base score of 9.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected Fusion Middleware versions: 11.1.1.4.0; 11.1.1.6.0; 11.1.2.0. The record does not name a fixed version, so check the vendor advisory. CISA added it to the Known Exploited Vulnerabilities catalogue on November 3, 2021, which means attacks have been observed in the wild.
Attackers are already exploiting this vulnerability, according to CISA.
What to do
- Check which version of Fusion Middleware you run against the affected versions below, and install the vendor's latest release.
- CISA's required action: Apply updates per vendor instructions.
- Read the advisory on oracle.com for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Oracle | Fusion Middleware | 11.1.1.4.0; 11.1.1.6.0; 11.1.2.0 | Not stated |
Version data comes from NVD's product matching. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- NoneAvailability is not affected.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 9.1 | Critical | NVD |
| CVSS 3.1 | 9.1 | Critical | CISA (ADP) |
| CVSS 2.0 | 6.4 | Medium | NVD |
Official description
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the URLPARAMETER functionality allows remote attackers to read and upload arbitrary files to reports/rwservlet, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3153 to execute arbitrary code by uploading a .jsp file.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
Timeline
- CVE record published.
- Added to CISA's Known Exploited Vulnerabilities catalogue.
- Deadline for US federal agencies to remediate, set by CISA.
- CISA published its SSVC assessment (exploitation: active, automatable: yes, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Third-party and government advisories
- seclists.org/fulldisclosure/2014/Jan/186Mailing List, Third Party Advisory
- exchange.xforce.ibmcloud.com/vulnerabilities/79295Third Party Advisory, VDB Entry
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-3152US Government Resource
Technical write-ups (may include proof of concept)
- exploit-db.com/exploits/31253Exploit, Third Party Advisory, VDB Entry
- youtube.com/watch?v=NinvMDOj7sMExploit
Other vulnerabilities in Fusion Middleware
- 7.5 High severity
- 4.7 Medium severity
Oracle Fusion Middleware Unspecified Exploited
- 9.8 Critical severity
Oracle Fusion Middleware Unspecified Exploited
Spotted an error? Tell us.