# CVE-2012-3152: Oracle Fusion Middleware Unspecified Vulnerability

> CVE-2012-3152: Oracle Fusion Middleware Unspecified Vulnerability. CVSS 9.1 (CVSS 3.1), in CISA KEV.

Canonical: https://rewindex.com/cve/CVE-2012-3152
Last updated: 2025-10-22T00:05:45Z

- Published: 2012-10-16 23:00 UTC · Updated: 2025-10-22 00:05 UTC · Assigner: oracle
- CVSS: 9.1 (CVSS 3.1) · Severity: Critical · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS: 98.8%, 100th percentile (scored 2026-10-25)
- CISA KEV: yes, added 2021-11-03, federal due date 2022-05-03, ransomware use: Unknown

## Description

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component.  NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the URLPARAMETER functionality allows remote attackers to read and upload arbitrary files to reports/rwservlet, and that this issue occurs in earlier versions.  NOTE: this can be leveraged with CVE-2012-3153 to execute arbitrary code by uploading a .jsp file.

## CISA required action

Apply updates per vendor instructions.

## Affected vendors and products

- Oracle: Fusion Middleware

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2012-3152)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2012-3152)
- [http://blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153/](http://blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153/)
- [http://blog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11g/](http://blog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11g/)
- [http://seclists.org/fulldisclosure/2014/Jan/186](http://seclists.org/fulldisclosure/2014/Jan/186)
- [https://exchange.xforce.ibmcloud.com/vulnerabilities/79295](https://exchange.xforce.ibmcloud.com/vulnerabilities/79295)
- [http://www.exploit-db.com/exploits/31253](http://www.exploit-db.com/exploits/31253)
- [http://www.mandriva.com/security/advisories?name=MDVSA-2013:150](http://www.mandriva.com/security/advisories?name=MDVSA-2013:150)
- [http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html](http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html)
- [http://www.osvdb.org/86394](http://www.osvdb.org/86394)
- [http://www.osvdb.org/86395](http://www.osvdb.org/86395)
- [http://www.securityfocus.com/bid/55955](http://www.securityfocus.com/bid/55955)
- [http://www.youtube.com/watch?v=NinvMDOj7sM](http://www.youtube.com/watch?v=NinvMDOj7sM)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2012-3152 · Markdown: https://rewindex.com/cve/CVE-2012-3152.md · JSON: https://rewindex.com/api/v1/cves/CVE-2012-3152 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:01:44.537Z