WaratekVRT Sign in

CVE-2012-1710 Oracle Fusion Middleware

Affected softwareOracle Fusion Middleware
Affected versions10.1.3.5
Severity9.8 Critical CVSS 3.1 3 scores
Fixed inOracle Critical Patch Update April 2012
Published3 May 2012
Updated13 Nov 2026

Description

Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Designer, a different vulnerability than CVE-2012-1709.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-05-25 · remediation due 2022-06-15 · ransomware use: known
  • VulnCheck KEV listed Exploitation reported in the wild. 3 citations · earliest 2021-02-11.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: total.
  • Indexed PoC none indexed
  • EPSS 7.8% chance in 30 days

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2012-1710 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation cybersecurityworks.com /pdf/ransomware/Spotlight_Ransomware2021.pdf 2021-02-11
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2022-05-25
Reported exploitation info.securin.io /hubfs/Securin%20Ransomware%20Report%202023.pdf 2023-02-14

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection unknown
  • Action not assessed
  • Review automated Upstream data
  • Record active
Decided by A researcher's recorded decision for this specific CVE
Finding A researcher set this CVE's status to No source fix or exploit. CISA KEV lists it as exploited in the wild, added 2022-05-25 with remediation due 2022-06-15. The file records no review date. VRT lists it as a mitigation candidate until a researcher reviews the file again. No rule exists and none is planned.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

  • Unspecified vulnerability in the Oracle WebCenter Forms Recognition Designer component (Fusion Middleware 10.1.3.5), addressed by Oracle's April 2012 CPU. Oracle never disclosed the attack vector beyond "unknown vectors related to Designer", and despite the CRITICAL 9.8 score, no exploit code has appeared in the fourteen years since disclosure.
  • With no working exploit published and no technical detail to reverse- engineer one from, there is nothing concrete to build an ARMR rule against.

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2012 ↗ CPU 2012-Q2 Oracle Fusion Middleware / Designer (10.1.3.5)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware Designer 10.1.3.5 10.1.3.5

Products and versions

1 product, 1 version entry
SourceVendorProductSchemeAffected versions
nvd oracle fusion middleware generic 10.1.3.5

References

URLTags
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 Broken Link
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html Patch, Vendor Advisory
http://www.securitytracker.com/id?1026949 Broken Link, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1710 US Government Resource

Timeline
Published2012-05-03By the CVE Program.
VulnCheck KEV: earliest evidence2021-02-11Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2022-05-25Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: latest evidence2023-02-14Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-10-01NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.