Actively exploited · Published Oct 16, 2012 · Assigned by oracle

CVE-2012-0518

Medium 4.7 Exploited

In plain English

A medium-severity open redirect in Fusion Middleware from Oracle. Attackers are actively exploiting it in the wild (listed by CISA on March 28, 2022). The chance it is exploited in the next 30 days is estimated at 4.7% (higher than 92% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)4.7%top 8.2% of all CVEs

Exploited in the wildYesCISA KEV since Mar 28, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 18, 2022.

Official description

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-3175.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

References

http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html x_refsource_CONFIRM
MDVSA-2013:150 vendor-advisory, x_refsource_MANDRIVA
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0518 government-resource