CVE-2012-3153 Official NVD Security Advisory (CVSS 6.4)
Executive & SecOps Summary
SECOPS ASSESSMENTImpacted configurations listed under CVE-2012-3153
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remo...
Review official patches and verify network isolation controls.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUNDApply the latest security updates provided by the official software maintainers.
Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
Official NVD Technical Description
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the PARSEQUERY function allows remote attackers to obtain database credentials via reports/rwservlet/parsequery, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3152 to execute arbitrary code by uploading a .jsp file.
- CVSS Score: 6.4 (MEDIUM)
- CWE IDs: N/A
Official Vendor Advisories & References
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the PARSEQUERY function allows remote attackers to obtain database credentials via reports/rwservlet/parsequery, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3152 to execute arbitrary code by uploading a .jsp file.
Frequently Asked SecOps Questions (CVE-2012-3153)
FAQQ1. How critical is CVE-2012-3153 and is it actively exploited in the wild?
CVE-2012-3153 is rated CVSS 6.4 (MEDIUM) with a 30-day EPSS exploitation probability of 98.2%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2012-3153?
Primary impacted vendors include security-advisory across software. Scope summary: Refer to official NVD CPE configuration entries
Q3. What temporary mitigations or workarounds exist for CVE-2012-3153 before patching?
[Mitigation] Review official patches and verify network isolation controls. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2012-3153
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (security-advisory)
View Category →CVE-2026-120114 Technical Vulnerability Analysis & Patch Advisory (CVSS 7.2)
[Affected Scope] Systems running unpatched versions impacted by CVE-2026-120114
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.