WaratekVRT Sign in

CVE-2012-0518 Oracle Fusion Middleware

Affected softwareOracle Fusion Middleware
Affected versions10.1.4.3.0
Severity4.7 Medium CVSS 3.1 3 scores
Fixed inOracle Critical Patch Update October 2012
WeaknessCWE-601
Published16 Oct 2012
Updated13 Nov 2026

Description

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-3175.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-03-28 · remediation due 2022-04-18 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 2 citations · earliest 2013-05-17.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: partial.
  • Indexed PoC none indexed
  • EPSS 4.7% chance in 30 days

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2012-0518 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation secuobs.com /revue/news/446124.shtml 2013-05-17
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2022-03-28

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection unknown
  • Action not assessed
  • Review automated Upstream data
  • Record active
Decided by A researcher's recorded decision for this specific CVE
Finding A researcher set this CVE's status to No source fix or exploit. CISA KEV lists it as exploited in the wild, added 2022-03-28 with remediation due 2022-04-18. The file records no review date. VRT lists it as a mitigation candidate until a researcher reviews the file again. No rule exists and none is planned.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

  • Unspecified vulnerability in the Oracle Application Server Single Sign-On component (10.1.4.3.0), reported via redirect-related unknown vectors. Oracle's own advisory never disclosed the mechanism, and no exploit code has surfaced in the fourteen years since disclosure.
  • Absent a public write-up of what "unknown vectors related to Redirects" actually means, there is nothing to build a rule against.

CVSS

4.7 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 4.7 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N NVD Primary published
CVSS 3.1 4.7 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N CISA-ADP Secondary
CVSS 2.0 4.3 none AV:N/AC:M/Au:N/C:N/I:P/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update October 2012 ↗ CPU 2012-Q4 Oracle Fusion Middleware / Cookies/Tokens, Redirects (10.1.4.3.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware Cookies/Tokens, Redirects 10.1.4.3.0 10.1.4.3.0

Products and versions

1 product, 1 version entry
SourceVendorProductSchemeAffected versions
nvd oracle fusion middleware generic 10.1.4.3

References

URLTags
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 Broken Link
http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0518 US Government Resource

Timeline
Published2012-10-16By the CVE Program.
VulnCheck KEV: earliest evidence2013-05-17Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2022-03-28Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: latest evidence2022-03-28Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-16NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.