CVE-2012-3152
Oracle Fusion Middleware Unspecified Vulnerability
Description
CVE-2012-3152 is a critical-severity vulnerability in Oracle Reports Developer, a component of Oracle Fusion Middleware. This unspecified vulnerability in the Report Server Component allows remote attackers to read and upload arbitrary files through the URLPARAMETER functionality of the reports/rwservlet endpoint, affecting the confidentiality and integrity of the system. When chained with CVE-2012-3153, this vulnerability can be leveraged to achieve remote code execution by uploading a malicious .jsp file. CISA has added CVE-2012-3152 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. With an EPSS score of 93.16% (99.8th percentile), this vulnerability has a near-certain probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | fusion middleware | 11.1.1.4.0; 11.1.1.6.0; 11.1.2.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- http://blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153/(Broken Link)
- http://blog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11g/(Broken Link)
- http://seclists.org/fulldisclosure/2014/Jan/186(Mailing List, Third Party Advisory)
- http://www.exploit-db.com/exploits/31253(Exploit, Third Party Advisory, VDB Entry)
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:150(Broken Link)
- http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html(Patch, Vendor Advisory)
- http://www.osvdb.org/86394(Broken Link)
- http://www.osvdb.org/86395(Broken Link)
- http://www.securityfocus.com/bid/55955(Broken Link, Third Party Advisory, VDB Entry)
- http://www.youtube.com/watch?v=NinvMDOj7sM(Exploit)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/79295(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-3152(US Government Resource)
Weakness Type
NVD-CWE-noinfo: Insufficient Information
The specific weakness type for CVE-2012-3152 has not been formally classified by NVD. However, the vulnerability involves improper access control in the URLPARAMETER functionality of Oracle Reports Developer, which allows unauthorized file read and upload operations through the reports/rwservlet endpoint.
Learn more: NVD CWE Classification
Impact Analysis
CVE-2012-3152 carries a CVSS 3.1 score of 9.1 (CRITICAL), reflecting severe impact potential. The vulnerability is remotely exploitable over the network without physical access, requires low attack complexity with no special conditions needed, and demands no authentication or user interaction to trigger. Confidentiality (High): An attacker can read arbitrary files on the Oracle Reports server, potentially exposing database connection strings, configuration files, and sensitive business data. Integrity (High): The file upload capability allows attackers to place malicious files on the server, and when combined with CVE-2012-3153, this can lead to full code execution via JSP webshell upload. Availability (None): While the direct vulnerability does not impact availability, successful exploitation through chaining could lead to complete system compromise. The EPSS score of 93.16% places this vulnerability in the 99.8th percentile, indicating near-certain exploitation activity.
Exploit Maturity
CVE-2012-3152 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is available via Exploit-DB and a video demonstration is available on YouTube. The EPSS score of 93.16% indicates near-certain exploitation activity, placing it among the most actively targeted vulnerabilities. Notably, this vulnerability can be chained with CVE-2012-3153 to escalate from file read/upload to full remote code execution by uploading a .jsp webshell. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Oracle has released patches via the October 2012 Critical Patch Update.
- Verify that all instances of Oracle Fusion Middleware (versions 11.1.1.4, 11.1.1.6, and 11.1.2.0) running Oracle Reports Developer have been updated to patched versions.
- If immediate patching is not possible, restrict network access to the reports/rwservlet endpoint using firewall rules and reverse proxy configurations. Block external access to Oracle Reports Server administrative interfaces entirely.
- Monitor server access logs for suspicious requests to the reports/rwservlet endpoint, particularly those containing URLPARAMETER manipulations or attempts to upload .jsp files. Review file system integrity for unauthorized file modifications.
- Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns and unauthorized file upload attempts targeting the Oracle Reports Server component.
Technical Details
CVE-2012-3152 affects the Oracle Reports Developer component within Oracle Fusion Middleware versions 11.1.1.4, 11.1.1.6, and 11.1.2.0. The vulnerability exists in the Report Server Component's URLPARAMETER functionality accessible through the reports/rwservlet endpoint. This functionality allows remote attackers to both read arbitrary files from and upload arbitrary files to the server without authentication. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms network-based exploitation with no prerequisites, resulting in high confidentiality and integrity impact while availability is not directly affected. The critical aspect of this vulnerability is its chainability with CVE-2012-3153, which together enable an attacker to upload a .jsp file and execute arbitrary code on the application server.
Frequently Asked Questions
Is CVE-2012-3152 being actively exploited?
Yes. CVE-2012-3152 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 93.16% (99.8th percentile) indicates near-certain exploitation activity. No known ransomware campaigns are currently associated with this vulnerability.
What products are affected by CVE-2012-3152?
CVE-2012-3152 affects Oracle Fusion Middleware versions 11.1.1.4.0, 11.1.1.6.0, and 11.1.2.0, specifically the Oracle Reports Developer component and its Report Server Component.
How do I fix CVE-2012-3152?
Apply Oracle's October 2012 Critical Patch Update immediately. Update all Oracle Fusion Middleware instances running Reports Developer to patched versions. If immediate patching is not possible, restrict access to the reports/rwservlet endpoint from untrusted networks.
How severe is CVE-2012-3152?
CVE-2012-3152 has a CVSS 3.1 score of 9.1 (CRITICAL). When chained with CVE-2012-3153, it enables full remote code execution. With an EPSS score in the 99.8th percentile and confirmed active exploitation, this is an extremely high-priority vulnerability requiring immediate attention.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.