CVE-2012-0518
Oracle Fusion Middleware Unspecified Vulnerability
Description
CVE-2012-0518 is a session fixation vulnerability in Oracle iPlanet Web Server 7.0, a component of Oracle Fusion Middleware. The flaw allows a remote attacker to hijack user sessions by fixing the session identifier before the user authenticates, enabling unauthorized access to the victim's authenticated session. With an EPSS score of 0.3% (70.6th percentile), this vulnerability has seen moderate exploitation interest. CISA has added CVE-2012-0518 to the Known Exploited Vulnerabilities catalog, confirming exploitation in real-world attacks.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | fusion middleware | 10.1.4.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
References
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:150(Broken Link)
- http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0518(US Government Resource)
Weakness Type
CWE-384: Session Fixation
CVE-2012-0518 is a session fixation vulnerability in Oracle iPlanet Web Server. The web server fails to regenerate the session identifier after successful authentication, allowing an attacker who has pre-set a known session ID to gain access to the victim's authenticated session after they log in.
Learn more: CWE-384 — Session Fixation
Impact Analysis
CVE-2012-0518 has a CVSS v2 base score of 4.3 (Medium), as the attack requires the victim to click on a crafted link or visit a malicious page that sets the session identifier. While the CVSS score is moderate, the impact of successful exploitation is significant: the attacker gains full access to the victim's authenticated session, including any privileges and data accessible to that user. The EPSS score of 0.3% (70.6th percentile) indicates moderate exploitation activity. The inclusion in CISA's KEV catalog confirms that this vulnerability has been exploited in real-world attacks targeting organizations using Oracle iPlanet Web Server.
Exploit Maturity
CVE-2012-0518 has been exploited in targeted attacks against organizations running Oracle iPlanet Web Server. CISA confirmed active exploitation by including it in the KEV catalog. Session fixation attacks are well-understood and straightforward to execute, requiring only that the attacker convince the victim to use a pre-set session identifier. The EPSS score of 0.3% (70.6th percentile) reflects ongoing but moderate exploitation interest.
Remediation
- Apply Oracle's Critical Patch Update that addresses CVE-2012-0518 in iPlanet Web Server 7.0. Contact Oracle support for the specific patch applicable to your installation.
- Migrate to a supported web server if still running Oracle iPlanet Web Server, as it has reached end of life. Consider Apache HTTP Server, Nginx, or other actively maintained web servers.
- Implement session ID regeneration at the application level upon successful authentication to mitigate session fixation attacks, even if the underlying web server is vulnerable.
- Configure secure session management including setting the HttpOnly and Secure flags on session cookies, implementing session timeouts, and validating session origins.
- Deploy web application firewall (WAF) rules to detect and block session fixation attempts, including monitoring for suspicious session ID patterns in requests.
Technical Details
CVE-2012-0518 is a session fixation vulnerability (CWE-384) in Oracle iPlanet Web Server 7.0, part of the Oracle Fusion Middleware stack. The vulnerability exists because the web server does not regenerate the session identifier (typically stored in a session cookie) after a user successfully authenticates. This allows an attacker to set a known session ID in the victim's browser through various means, such as crafted links with session parameters, cross-site scripting, or meta tag injection. When the victim subsequently authenticates using the attacker's pre-set session ID, the attacker can use that same session ID to access the authenticated session, effectively bypassing the login process. The attack exploits the fundamental session management weakness of maintaining the same session identifier across authentication state changes.
Frequently Asked Questions
Is CVE-2012-0518 being actively exploited?
Yes, CISA has confirmed active exploitation by adding CVE-2012-0518 to the Known Exploited Vulnerabilities catalog. Session fixation attacks are straightforward to execute once the vulnerable server is identified.
What products are affected by CVE-2012-0518?
Oracle iPlanet Web Server 7.0, which is part of Oracle Fusion Middleware, is affected. Organizations using this web server for hosting web applications are at risk.
How do I fix CVE-2012-0518?
Apply Oracle's Critical Patch Update for iPlanet Web Server 7.0 or migrate to a supported web server. Implement session ID regeneration upon authentication at the application level as an additional defense.
How severe is CVE-2012-0518?
CVE-2012-0518 has a CVSS v2 score of 4.3 (Medium). While the score is moderate, successful exploitation allows an attacker to fully hijack authenticated user sessions, potentially gaining access to sensitive data and functionality.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.