WaratekVRT Sign in

CVE-2012-3153 Oracle Fusion Middleware

Affected softwareOracle Fusion Middleware
Affected versions11.1.1.4, 11.1.1.6, 11.1.2.0
Severity6.4 Medium CVSS 2.0
Fixed inOracle Critical Patch Update October 2012
Published16 Oct 2012
Updated16 Jun 2026

Description

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the PARSEQUERY function allows remote attackers to obtain database credentials via reports/rwservlet/parsequery, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3152 to execute arbitrary code by uploading a .jsp file.

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 1 citation · 2 exploits · earliest 2025-06-07.
  • CISA Vulnrichment no assessment published
  • Indexed PoC 4 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2014-01-28.
  • EPSS 98% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2012-3153 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation app.crowdsec.net /cti/cve-explorer/CVE-2012-3153 2025-06-07
Exploit reference VulnCheck XDB 9b10640bb794 Exploit type: initial-access 2014-01-28
Exploit reference VulnCheck XDB db0bdd40ee65 Exploit type: initial-access 2026-05-15
IndexArtifactStarsFirst seen
GitHub PoC Automated exploit for CVE-2012-3153 / CVE-2012-3152 8 2014-01-28
Exploit-DB Oracle Forms and Reports 11.1 - Arbitrary Code Execution 2014-01-29
Nuclei Oracle Forms & Reports RCE (CVE-2012-3152 & CVE-2012-3153)
Metasploit Oracle Forms and Reports Remote Code Execution (great rank)

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full
  • Action available patch rule
  • Review human ARMR file
  • Record active
Decided by An ARMR patch file on disk for this CVE
Finding CVE is covered by a multi-CVE ARMR patch rule

ARMR rule files

1 file

The rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.

CVE-2012-3153.armr patch rule, ARMR 2.6 added 2020-06-25 updated 2026-03-04
Sign in to download

How to mitigate CVE-2012-3153

Apply the fix in Oracle Critical Patch Update October 2012. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update October 2012 ↗ CPU 2012-Q4 Oracle Fusion Middleware / Servlet (11.1.1.4, 11.1.1.6, 11.1.2.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware Servlet 11.1.1.4, 11.1.1.6, 11.1.2.0 11.1.1.4 · 11.1.1.6 · 11.1.2.0

Products and versions

1 product, 3 version entries
SourceVendorProductSchemeAffected versions
nvd oracle fusion middleware generic 11.1.1.4.0 · 11.1.1.6.0 · 11.1.2.0

References

URLTags
http://blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153/
http://blog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11g/
http://seclists.org/fulldisclosure/2014/Jan/186
http://www.exploit-db.com/exploits/31253
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/55961
https://exchange.xforce.ibmcloud.com/vulnerabilities/79296

Timeline
Published2012-10-16By the CVE Program.
ARMR remediation created2020-06-25Earliest commit adding this CVE's ARMR patch or security rule.
VulnCheck KEV: earliest evidence2025-06-07Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
ARMR remediation last updated2026-03-04Most recent commit touching this CVE's ARMR patch or security rule.
Last VRT activity2026-03-04Most recent commit touching this CVE's classification, patch or rule file.
VulnCheck KEV: latest evidence2026-05-15Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-16NVD's own last-modified date for this record.