VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 18 hours ago

CVE-2012-3137

6.4 Medium Out of RASP scope

Description

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability."

CWE-287 · Improper authentication

Exploitation Status

Working exploit published

A reviewed exploit catalogue carries this CVE. Somebody has published code a stranger can run.

CVSS E:P

  • CISA KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 3 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC; first seen 2012-10-18.
  • EPSS 31% chance in 30 days A model prediction, not an observation. Higher than 98% of all scored CVEs.

2 of these are GitHub repositories below the 5★ evidence bar. They are listed because a person may still want to open one; they do not count toward the exploit maturity above.

IndexArtifactStarsFirst seen
GitHub PoC Exploit for cve-2012-3137 Oracle challenge 4 2014-06-18
GitHub PoC Attempts to exploit CVE-2012-3137 on vulnerable Oracle servers 3 2014-03-29
Exploit-DB Oracle Database - Protocol Authentication Bypass 2012-10-18

Waratek Defense Posture

Out of RASP scope

A genuine Java vulnerability in a supported product that the agent cannot reach: a coverage gap, not an out-of-domain finding.

  • Protection none
  • Action not-needed none
  • Review human manual-review
  • Record active
Decided by manual classification : Manual classification of this CVE in the legacy dataset
Finding Manual classification marked OUT-OF-SCOPE but CVE matches known CPE products

CVSS

6.4 v2.0 AV:N/AC:L/Au:N/C:P/I:P/A:N 1 metric

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 2.0 6.4 no band published AV:N/AC:L/Au:N/C:P/I:P/A:N NVD Primary published

Affected Software & Releases

🏛️ Oracle CPU Advisories & Products

AdvisoryTypeQuarterProducts Oracle named in risk matrix
Oracle Critical Patch Update July 2016 ↗ CPU 2016-Q3 Oracle Primavera Products Suite / Web access (8.2, 8.3, 8.4)
Oracle Critical Patch Update October 2012 ↗ CPU 2012-Q4 Oracle Database Server / Core RDBMS (10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, 11.2.0.3)

Indexed Oracle Components & Versions

FamilyComponentOracle's version cell (verbatim)Indexed as
Oracle Database Server Core RDBMS 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, 11.2.0.3 10.2.0.3 · 10.2.0.4 · 10.2.0.5 · 11.1.0.7 · 11.2.0.2 · 11.2.0.3
Oracle Primavera Products Suite Web access 8.2, 8.3, 8.4 8.2 · 8.3 · 8.4

🖥️ Product CPEs & Version Ranges

2 product(s) over 9 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd oracle database server generic 10.2.0.3 · 10.2.0.4 · 10.2.0.5 · 11.1.0.7 · 11.2.0.2 · 11.2.0.3
nvd oracle primavera p6 enterprise project portfolio management generic 8.2 · 8.3 · 8.4

Manual classification context

A reviewer manually classified this CVE. The retained record includes the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** HTTP, WEB ACCESS, SEE NOTE 1, NO AUTH REMOTE EXPLOIT, ORACLE NET **Products:** PRIMAVERA P6 ENTERPRISE PROJECT PORTFOLIO MANAGEMENT, CORE RDBMS, ORACLE DATABASE SERVER, ORACLE PRIMAVERA PRODUCTS SUITE, ORACLE-SERVER

References

URLTags
http://arstechnica.com/security/2012/09/oracle-database-stealth-password-cracking-vulnerability/ Press/Media Coverage
http://threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-password-cracking-092012?utm_source=Threatpost&utm_medium=Tabs&utm_campaign=Today%27s+Most+Popular Press/Media Coverage
http://www.darkreading.com/authentication/167901072/security/application-security/240007643/attack-easily-cracks-oracle-database-passwords.html Press/Media Coverage
http://www.exploit-db.com/exploits/22069 Exploit, Third Party Advisory, VDB Entry
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 Broken Link
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Patch, Vendor Advisory
http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/55651

Timeline

Published 2012-09-21 Last modified 2026-06-16
Published2012-09-21By the CVE Program.
NVD record modified2026-06-16NVD's own last-modified date for this record.