CVE-2012-3153: Oracle Fusion Middleware Reports Developer Servlet credential disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityUnauthenticated network access with partial confidentiality and integrity impact, a very high EPSS score, and public exploit references, though not in KEV.

What it is

Oracle Reports Developer in Fusion Middleware 11.1.1.4, 11.1.1.6 and 11.1.2.0 has an unspecified flaw in the Servlet component that affects confidentiality and integrity. Oracle has not confirmed the researcher's claim that the PARSEQUERY function at reports/rwservlet/parsequery exposes database credentials, and the issue is reported to affect earlier versions as well.

Impact

A remote attacker can read and modify data through the affected component, and the researcher claims database credentials can be obtained. Chained with CVE-2012-3152, it can lead to arbitrary code execution via a .jsp upload.

Attack surface

Reachable over the network through the Reports Developer Servlet, with no authentication or user interaction required per the CVSS vector AV:N/AC:L/Au:N. The claimed vector is the reports/rwservlet/parsequery endpoint.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.9822, 99.9th percentile) and public references include an Exploit-DB entry and researcher blog posts describing exploit release.

What to do

• Apply the Oracle October 2012 Critical Patch Update or later for Fusion Middleware Reports Developer.
• If Reports Developer is not needed, disable or remove the component and block external access to /reports/rwservlet.
• Restrict network access to the Reports servlet to trusted hosts only.
• Rotate any database credentials that may have been exposed through the Reports servlet.
• Monitor for and prevent .jsp file uploads to the Reports application to break the CVE-2012-3152 chain.

Detection

• Alert on requests to /reports/rwservlet/parsequery and other rwservlet endpoints from untrusted sources.
• Review web and application logs for anomalous Reports Developer servlet requests or unexpected parameters.
• Monitor for .jsp files written into Reports application directories or web-accessible paths.
• Hunt for outbound database connections or credential use originating from the Reports server host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.