CVE-2012-3152 KEVPublic exploit Critical · 9.1 EPSS 98.8%

Oracle Fusion Middleware Unspecified Vulnerability

Oracle · Fusion Middleware

Summary

An unspecified flaw in the Oracle Reports Developer component of Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 affects the Report Server Component. A remote, unauthenticated attacker with no user interaction can compromise confidentiality and integrity through unknown vectors, and reportedly through the URLPARAMETER functionality in reports/rwservlet to read and upload arbitrary files.

Official description · NVD

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the URLPARAMETER functionality allows remote attackers to read and upload arbitrary files to reports/rwservlet, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3153 to execute arbitrary code by uploading a .jsp file.

Breakdown

73.2 / 100

Exploited: Yes, in CISA KEV
Reports: 1
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationAI-written (claude-haiku-5-5)Medium confidence149 general detection rules
What they do
- Read files and data on the systemT1005 · Data from Local SystemAI-written (claude-haiku-5-5)Medium confidence14 general detection rules

First seen exploited 8 years after disclosure. Public exploit code (Metasploit) appeared 15 months after disclosure.

Disclosed16 Oct 2012day 0
Public exploit codeMetasploit15 Jan 2014+15 mo
First seen exploitedVulnCheck KEV evidence1 Jan 2021+8 yrs
Added to CISA KEVEU database agrees3 Nov 2021+9 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

AI mapping from the description · how it is exploited

remote unauthenticated attack against public-facing web component

allows remote attackers to affect confidentiality and integrity via unknown vectors

From the official description (NVD) Original ↗

CollectionTA0009

Data from Local System T1005 Medium

AI mapping from the description · primary impact

arbitrary file read from local system

allows remote attackers to read and upload arbitrary files to reports/rwservlet

From the official description (NVD) Original ↗

Detection

0 rules for this CVE · 163 general rules for its techniques

Rules for this CVE

0 that reference CVE-2012-3152 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Data from Local SystemT100514 general rules

OpenCanary - SMB File Open Requesthightest
Potential Conti Ransomware Database Dumping Activity Via SQLCmdhightest
SQLite Chromium Profile Data DB Accesshightest
SQLite Firefox Profile Data DB Accesshightest
VeeamBackup Database Credentials Dump Via Sqlcmd.EXEhightest
Script Interpreter Spawning Credential Scanner - Linuxhighexperimental
Script Interpreter Spawning Credential Scanner - Windowshighexperimental
Shai-Hulud NPM Package Malicious Exfiltration via Curlhighexperimental

All 14 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report

1 reportclearskysec.com

Reports are matched by finding the exact id CVE-2012-3152 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

clearskysec.comUndated

____________________________________________________________________________________________________

Server CVE-2019-3396 Tactic: Initial Access ID: TA0001 Technique: Exploit Public-Facing Application ID: T1190 Tactic: Collection ID: TA0009 Technique: Data from Information Repositories: Confluence ID: T1213.001 - Atlassian Jira Server or Data Center CVE-2019-11581 - Oracle 10g 11.1.2.0 CVE-2012-3152…

Original (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

12 links, grouped by NVD tag (11 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 3 Nov 2021. Federal due date 3 May 2022. No recorded ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 3 Nov 2021. EUVD-2012-3130

Oracle Forms and Reports 11.1 - Arbitrary Code ExecutionEDB-31253 · remote · jsp · 2014-01-29
Oracle Forms and Reports - Remote Code Execution (Metasploit)EDB-31737 · remote · windows · 2014-02-18 · verified

, 30 Oct 2026

98.8%Top 0.07%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.93%).

3.1

9.1Critical · 9.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 2129 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9993 20.0/20

Threat reports1 report 3.9/10

Public exploit code2 NVD references tagged Exploit; 2 Exploit-DB entries; 1 PoC-in-GitHub repo; 1 Metasploit module 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 9.1 6.4/7

End-of-life productsupported or unknown 0.0

Total73.2

Record

Published: 16 Oct 2012
Modified: 16 Jun 2026
: None assigned
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

CollectionTA0009

Detection

Rules for this CVE

General rules for this CVE’s techniques

What security researchers reported

____________________________________________________________________________________________________

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

US Government Resource 1

Third Party Advisory 4

Exploit 1

Broken Link 5

How attackers get in

What they do

techniques