CVE-2012-3153
Oracle Forms and Reports 11.1 - Arbitrary Code Execution
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the PARSEQUERY function allows remote attackers to obtain database credentials via reports/rwservlet/parsequery, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3152 to execute arbitrary code by uploading a .jsp file.
Vulnerabilidad no especificada en el componente de Oracle Reports Developer de Oracle Fusion Middleware v11.1.1.4, v11.1.1.6 y v11.1.2.0 permite a atacantes remotos afectar a la confidencialidad y la integridad a través de vectores desconocidos relacionados con Servlet.
An undocumented PARSEQUERY function in Oracle Forms and Reports allows dumping database username and passwords unauthenticated. The patch / workaround just appears to obfuscate the issue but not actually address it. Affected systems include versions 9iAS, 9iDS, 10G (DS and AS), and 10G AS Reports/Forms Standalone Installation, 11g if patch or workaround not applied. In 12g a code rewrite has mitigated this vulnerability.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2012-06-06 CVE Reserved
- 2012-10-16 CVE Published
- 2014-01-29 First Exploit
- 2024-08-06 CVE Updated
- 2024-09-11 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (9)
URL | Tag | Source |
---|---|---|
http://blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153 | X_refsource_misc | |
http://blog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11g | X_refsource_misc | |
http://seclists.org/fulldisclosure/2014/Jan/186 | Mailing List | |
http://www.securityfocus.com/bid/55961 | Vdb Entry | |
https://exchange.xforce.ibmcloud.com/vulnerabilities/79296 | Vdb Entry |
URL | Date | SRC |
---|---|---|
https://www.exploit-db.com/exploits/31253 | 2014-01-29 | |
http://www.exploit-db.com/exploits/31253 | 2024-08-06 |
URL | Date | SRC |
---|---|---|
http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html | 2017-08-29 |
URL | Date | SRC |
---|---|---|
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 | 2017-08-29 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Oracle Search vendor "Oracle" | Fusion Middleware Search vendor "Oracle" for product "Fusion Middleware" | 11.1.1.4.0 Search vendor "Oracle" for product "Fusion Middleware" and version "11.1.1.4.0" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Fusion Middleware Search vendor "Oracle" for product "Fusion Middleware" | 11.1.1.6.0 Search vendor "Oracle" for product "Fusion Middleware" and version "11.1.1.6.0" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Fusion Middleware Search vendor "Oracle" for product "Fusion Middleware" | 11.1.2.0 Search vendor "Oracle" for product "Fusion Middleware" and version "11.1.2.0" | - |
Affected
|