Oracle Fusion Middleware Reports Developer Remote Arbitrary File Read and Upload Vulnerability (CVE-2012-3152)
Executive & SecOps Summary
SECOPS ASSESSMENTOracle Fusion Middleware versions 11.1.1.4, 11.1.1.6, and 11.1.2.0 within the Oracle Reports Developer component.
Unauthenticated remote attackers can read or upload arbitrary files via the URLPARAMETER functionality, which can be chained with CVE-2012-3153 to achieve Remote Code Execution (RCE) via JSP web shell upload.
Apply the official Oracle Critical Patch Update (CPU) or restrict external access to the rwservlet endpoint and implement strict URL filtering.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Refer to the Oracle October 2012 Critical Patch Update (CPU) to apply the latest Patch Set Update (PSU). Use the OPatch utility to apply the patch as follows:
# Set Oracle environment variables
export ORACLE_HOME='/u01/app/oracle/middleware/oracle_common'
export PATH=$ORACLE_HOME/OPatch:$PATH
# Verify patch conflicts before applying
opatch prereq CheckConflictAgainstOHWithDetail -phBaseDir './2012_patch/'
# Apply the patch
opatch apply2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, restrict external access to the rwservlet endpoint using a reverse proxy or WAF.
# Nginx configuration to block malicious rwservlet requests
server {
listen 80;
server_name oracle-app.local;
location /reports/rwservlet {
# Block requests containing path traversal or URLPARAMETER keywords
if ($query_string ~* 'keymapfile|desname|URLPARAMETER') {
return 403;
}
proxy_pass http://127.0.0.1:7001;
}
}3. Log Audit & IoC Verification Commands
Scan web server access logs for exploitation attempts targeting the rwservlet endpoint.
# Search Apache/WebLogic access logs for path traversal and parameter abuse
grep -Ei 'rwservlet.*(keymapfile|desname|URLPARAMETER)' /var/log/httpd/access_log
# Monitor the web root directory for recently created JSP files
find /u01/app/oracle/middleware/ -name '*.jsp' -mtime -7 -lsBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability resides in the rwservlet servlet of the Oracle Reports Developer component in Oracle Fusion Middleware. Due to insufficient input validation when handling the URLPARAMETER parameter, the servlet is susceptible to path traversal and arbitrary file access. Attackers can exploit this flaw to bypass authentication and access sensitive configuration files (such as targets.xml or config.xml) on the server.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker can directly target the http://<target>/reports/rwservlet endpoint.
- Arbitrary File Read: By injecting path traversal sequences (
../../) into parameters likekeymapfileordesname, the attacker can retrieve arbitrary files from the local file system. - Arbitrary File Upload & RCE: The attacker leverages the
URLPARAMETERfunctionality to write arbitrary files to the server. When chained with CVE-2012-3153, this allows the attacker to upload a malicious.jspfile (web shell) into the web root directory and execute it, resulting in complete compromise of the host.
3. Infrastructure & Business Impact
This vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog and carries an EPSS score of 0.9879, indicating active and widespread exploitation. Successful exploitation can lead to the exposure of database credentials and sensitive configuration data, facilitating lateral movement. Furthermore, the resulting Remote Code Execution (RCE) capability poses a severe threat of ransomware deployment and complete infrastructure takeover.
Official Vendor Advisories & References
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the URLPARAMETER functionality allows remote attackers to read and upload arbitrary files to reports/rwservlet, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3153 to execute arbitrary code by uploading a .jsp file.
Frequently Asked SecOps Questions (CVE-2012-3152)
FAQQ1. How critical is CVE-2012-3152 and is it actively exploited in the wild?
CVE-2012-3152 is rated CVSS 9.1 (CRITICAL) with a 30-day EPSS exploitation probability of 98.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2012-3152?
Primary impacted vendors include oracle across fusion_middleware, reports_developer. Scope summary: Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 (Oracle Reports Developer component)
Q3. What temporary mitigations or workarounds exist for CVE-2012-3152 before patching?
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to the rwservlet endpoint and implement strict URL filtering. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2012-3152
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (oracle)
View Category →Oracle PeopleSoft Enterprise PeopleTools Remote Code Execution and System Takeover Vulnerability (CVE-2026-35273)
[Affected Scope] Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62
Oracle E-Business Suite Payments File Transmission Authentication Bypass and Remote Code Execution (CVE-2026-46817)
[Affected Scope] Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, specifically the Oracle Payments (File Transmission) component
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.