PT-2012-1215 · Oracle · Oracle Reports Developer+1

Miss_Sudo · Published 2012-10-16 · Updated 2025-03-13 · CVE-2012-3152

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions 11.1.1.4 through 11.1.2.0

Description The issue is related to insufficient access control in the Oracle Reports Developer component of Oracle Fusion Middleware. It may allow a remote attacker to impact the integrity and confidentiality of protected information via the HTTP protocol. The vulnerability can potentially be exploited to read and upload arbitrary files, and in combination with other issues, may allow the execution of arbitrary code by uploading a .jsp file.

Recommendations For versions 11.1.1.4 through 11.1.2.0, consider restricting access to the Report Server Component to minimize the risk of exploitation. As a temporary workaround, avoid using the URLPARAMETER functionality in the reports/rwservlet until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Weakness Enumeration

CWE-264

CWE-269

Related Identifiers

BDU:2021-05760

CVE-2012-3152

Affected Products

Oracle Fusion Middleware

Oracle Reports Developer

References · 20

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/oracle_reports_rce.rb · Exploit
• 🔥 http://exploit-db.com/exploits/31253 · Exploit
• 🔥 http://youtube.com/watch?v=NinvMDOj7sM · Exploit
• 🔥 https://exploit-db.com/exploits/31737 · Exploit
• 🔥 https://exploit-db.com/exploits/31253 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-3152 · Security Note
• https://bdu.fstec.ru/vul/2021-05760 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2013:150 · Vendor Advisory
• http://oracle.com/technetwork/topics/security/cpuoct2012-1515893.html · Vendor Advisory
• https://t.me/cvenotify/104990 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3152 · Note
• https://t.me/cvenotify/114765 · Telegram Post
• https://t.me/cvenotify/87386 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79295 · Note
• http://seclists.org/fulldisclosure/2014/Jan/186 · Note