CVE-2012-3153

🗓️ 16 Oct 2012 23:00:00Reported by oracleType

cve🔗 web.nvd.nist.gov👁 274 Views🌐 WEB

Unspecified vulnerability in Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet

Reporter	Title	Published	Views	Family All 29
0day.today	Oracle Forms and Reports 11.1 - Remote Exploit	29 Jan 201400:00	–	zdt
0day.today	Oracle Reports Developer Version Release 9i to 10gr2 Database Disclosure	29 Jan 201400:00	–	zdt
0day.today	Oracle Forms / Reports Remote Code Execution Exploit	18 Feb 201400:00	–	zdt
GithubExploit	Exploit for CVE-2012-3152	15 May 202620:47	–	githubexploit
ATTACKERKB	CVE-2012-3153	16 Oct 201200:00	–	attackerkb
ATTACKERKB	CVE-2012-3152	16 Oct 201200:00	–	attackerkb
Circl	CVE-2012-3153	29 May 201815:50	–	circl
Check Point Advisories	Oracle Fusion Middleware Showmap Servlet Information Disclosure (CVE-2012-3152; CVE-2012-3153)	6 Feb 201400:00	–	checkpoint_advisories
Check Point Advisories	Oracle Fusion Middleware Showenv Servlet Information Disclosure (CVE-2012-3152; CVE-2012-3153)	6 Feb 201400:00	–	checkpoint_advisories
Cvelist	CVE-2012-3153	16 Oct 201223:00	–	cvelist

NVD

Node

oracle fusion_middlewareMatch11.1.1.4.0

oracle fusion_middlewareMatch11.1.1.6.0

oracle fusion_middlewareMatch11.1.2.0

Source	Link
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/79296
blog	www.blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153/
exploit-db	www.exploit-db.com/exploits/31253
seclists	www.seclists.org/fulldisclosure/2014/Jan/186
mandriva	www.mandriva.com/security/advisories
blog	www.blog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11g/
oracle	www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
securityfocus	www.securityfocus.com/bid/55961

Parameter	Position	Path	Description	CWE
report	query param	/reports/rwservlet	Unauthenticated file read via rwservlet report parameter (CVE-2012-3152)	CWE-200
server	path	/reports/rwservlet/showenv	Leak server information and credentials via showenv (CVE-2012-3153 related workflow)	CWE-200
authid	path	/reports/rwservlet/showenv	Leak server information and credentials via showenv (CVE-2012-3153 related workflow)	CWE-200
server	path	/reports/rwservlet/parsequery	Parse rwservlet query to reveal command line and credentials (CVE-2012-3153 related)	CWE-200
authid	path	/reports/rwservlet/parsequery	Parse rwservlet query to reveal command line and credentials (CVE-2012-3153 related)	CWE-200
report	query param	/reports/rwservlet?report=test.rdf	Indirect path to upload/trigger payload via DES parameters (CVE-2012-3153)	CWE-200
desformat	query param	/reports/rwservlet?report=test.rdf	Indirect path to upload/trigger payload via DES parameters (CVE-2012-3153)	CWE-200
destype	query param	/reports/rwservlet?report=test.rdf	Indirect path to upload/trigger payload via DES parameters (CVE-2012-3153)	CWE-200
JOBTYPE	query param	/reports/rwservlet?report=test.rdf	Indirect path to upload/trigger payload via DES parameters (CVE-2012-3153)	CWE-200
URLPARAMETER	query param	/reports/rwservlet?report=test.rdf	Indirect path to upload/trigger payload via DES parameters (CVE-2012-3153)	CWE-200

29 Apr 2026 01:13Current

8.7High risk

Vulners AI Score8.7

CVSS 26.4

EPSS0.91652

In Wild