WaratekVRT Sign in

CVE-2012-3152 Oracle Fusion Middleware

Affected softwareOracle Fusion Middleware
Affected versions11.1.1.4, 11.1.1.6, 11.1.2.0
Severity9.1 Critical CVSS 3.1 3 scores
Fixed inOracle Critical Patch Update October 2012
Published16 Oct 2012
Updated16 Jun 2026

Description

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the URLPARAMETER functionality allows remote attackers to read and upload arbitrary files to reports/rwservlet, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3153 to execute arbitrary code by uploading a .jsp file.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2021-11-03 · remediation due 2022-05-03 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 3 citations · 2 exploits · earliest 2021-01-01.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 4 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit; first seen 2014-01-29.
  • EPSS 99% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2012-3152 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation clearskysec.com /wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf 2021-01-01
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2021-11-03
Reported exploitation greynoise.io /blog/coordinated-cloud-based-scanning-operation-targets-75-known-exposure-points 2025-05-27
Exploit reference VulnCheck XDB 5a65658eed42 Exploit type: initial-access 2014-01-28
Exploit reference VulnCheck XDB a9c7f157e132 Exploit type: initial-access 2026-05-15
IndexArtifactStarsFirst seen
GitHub PoC Automated exploitation scanner for Oracle Reports Server (rwservlet) — CVE-2012-3152 / CVE-2012-3153. Detects, fingerprints, reads files via LFI, tests SSRF via webhook, and uploads JSP shells. Targets Oracle Reports < 11g. For authorized use only. 6 2026-05-15
Exploit-DB Oracle Forms and Reports - Remote Code Execution (Metasploit) 2014-02-18
Exploit-DB Oracle Forms and Reports 11.1 - Arbitrary Code Execution 2014-01-29
Metasploit Oracle Forms and Reports Remote Code Execution (great rank)

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full
  • Action available patch rule
  • Review human ARMR file
  • Record active
Decided by An ARMR patch file on disk for this CVE
Finding CVE has an ARMR patch rule that provides mitigation

ARMR rule files

1 file

The rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.

CVE-2012-3152.armr patch rule, ARMR 2.6 added 2019-11-25 updated 2026-03-04
Sign in to download

How to mitigate CVE-2012-3152

Apply the fix in Oracle Critical Patch Update October 2012. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.1 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N NVD Primary published
CVSS 3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CISA-ADP Secondary
CVSS 2.0 6.4 none AV:N/AC:L/Au:N/C:P/I:P/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update October 2012 ↗ CPU 2012-Q4 Oracle Fusion Middleware / Report Server Component (11.1.1.4, 11.1.1.6, 11.1.2.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware Report Server Component 11.1.1.4, 11.1.1.6, 11.1.2.0 11.1.1.4 · 11.1.1.6 · 11.1.2.0

Products and versions

1 product, 3 version entries
SourceVendorProductSchemeAffected versions
nvd oracle fusion middleware generic 11.1.1.4.0 · 11.1.1.6.0 · 11.1.2.0

References

URLTags
http://blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153/ Broken Link
http://blog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11g/ Broken Link
http://seclists.org/fulldisclosure/2014/Jan/186 Mailing List, Third Party Advisory
http://www.exploit-db.com/exploits/31253 Exploit, Third Party Advisory, VDB Entry
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 Broken Link
http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html Patch, Vendor Advisory
http://www.osvdb.org/86394 Broken Link
http://www.osvdb.org/86395 Broken Link
http://www.securityfocus.com/bid/55955 Broken Link, Third Party Advisory, VDB Entry
http://www.youtube.com/watch?v=NinvMDOj7sM Exploit

Timeline
Published2012-10-16By the CVE Program.
ARMR remediation created2019-11-25Earliest commit adding this CVE's ARMR patch or security rule.
VulnCheck KEV: earliest evidence2021-01-01Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2021-11-03Listed in CISA's Known Exploited Vulnerabilities catalog.
ARMR remediation last updated2026-03-04Most recent commit touching this CVE's ARMR patch or security rule.
Last VRT activity2026-03-04Most recent commit touching this CVE's classification, patch or rule file.
VulnCheck KEV: latest evidence2026-05-15Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-16NVD's own last-modified date for this record.