CVE-2012-3153

🗓️ 16 Oct 2012 23:00:00Reported by oracleType

cve🔗 web.nvd.nist.gov👁 278 Views🌐 WEB

Unspecified vulnerability in Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet

Reporter	Title	Published	Views	Family All 32
0day.today	Oracle Forms and Reports 11.1 - Remote Exploit	29 Jan 201400:00	–	zdt
0day.today	Oracle Reports Developer Version Release 9i to 10gr2 Database Disclosure	29 Jan 201400:00	–	zdt
0day.today	Oracle Forms / Reports Remote Code Execution Exploit	18 Feb 201400:00	–	zdt
GithubExploit	Exploit for CVE-2012-3152	15 May 202620:47	–	githubexploit
ATTACKERKB	CVE-2012-3153	16 Oct 201200:00	–	attackerkb
ATTACKERKB	CVE-2012-3152	16 Oct 201200:00	–	attackerkb
Circl	CVE-2012-3153	29 May 201815:50	–	circl
Check Point Advisories	Oracle Fusion Middleware Showmap Servlet Information Disclosure (CVE-2012-3152; CVE-2012-3153)	6 Feb 201400:00	–	checkpoint_advisories
Check Point Advisories	Oracle Fusion Middleware Showenv Servlet Information Disclosure (CVE-2012-3152; CVE-2012-3153)	6 Feb 201400:00	–	checkpoint_advisories
CVE	CVE-2012-3152	16 Oct 201223:00	–	cve

NVD

Node

oracle fusion_middlewareMatch11.1.1.4.0

oracle fusion_middlewareMatch11.1.1.6.0

oracle fusion_middlewareMatch11.1.2.0

Source	Link
blog	www.blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153/
securityfocus	www.securityfocus.com/bid/55961
mandriva	www.mandriva.com/security/advisories
exploit-db	www.exploit-db.com/exploits/31253
blog	www.blog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11g/
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/79296
oracle	www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
seclists	www.seclists.org/fulldisclosure/2014/Jan/186

Parameter	Position	Path	Description
server	query param	reports/rwservlet/showenv	SSRF and credential disclosure via showenv in rwservlet
authid	query param	reports/rwservlet/showenv	SSRF and credential disclosure via showenv in rwservlet
<keymap>	query param	reports/rwservlet/parsequery	Parse keymaps and reveal server info to obtain credentials via PARSEQUERY
server	query param	reports/rwservlet/parsequery	Parse keymaps and reveal server info to obtain credentials via PARSEQUERY
authid	query param	reports/rwservlet/parsequery	Parse keymaps and reveal server info to obtain credentials via PARSEQUERY
report	query param	reports/rwservlet	Upload or execute a payload via rwservlet using JOBTYPE=rwurl and URLPARAMETER (cve-2012-3153/3152 chain)
desformat	query param	reports/rwservlet	Upload or execute a payload via rwservlet using JOBTYPE=rwurl and URLPARAMETER (cve-2012-3153/3152 chain)
destype	query param	reports/rwservlet	Upload or execute a payload via rwservlet using JOBTYPE=rwurl and URLPARAMETER (cve-2012-3153/3152 chain)
JOBTYPE	query param	reports/rwservlet	Upload or execute a payload via rwservlet using JOBTYPE=rwurl and URLPARAMETER (cve-2012-3153/3152 chain)
URLPARAMETER	query param	reports/rwservlet	Upload or execute a payload via rwservlet using JOBTYPE=rwurl and URLPARAMETER (cve-2012-3153/3152 chain)

16 Jun 2026 23:42Current

8.7High risk

Vulners AI Score8.7

CVSS 26.4

EPSS0.9822

In Wild