CVE-2012-3132: SQL Injection

Published Aug 10, 2012

Updated

SQL injection vulnerability in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to execute arbitrary SQL commands via vectors involving CREATE INDEX with a CTXSYS.CONTEXT INDEXTYPE and DBMSSTATS.GATHERTABLESTATS.

Affected Software

6 affected components

Oracle Database Server=10.2.0.3

Oracle Database Server=10.2.0.4

Oracle Database Server=10.2.0.5

Oracle Database Server=11.1.0.7

Oracle Database Server=11.2.0.2

Oracle Database Server=11.2.0.3

Event History

Aug 10, 2012

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-3132?

CVE-2012-3132 is considered a high severity vulnerability due to its potential to allow remote authenticated users to execute arbitrary SQL commands.

How do I fix CVE-2012-3132?

To mitigate CVE-2012-3132, users should upgrade Oracle Database Server to a version that is not susceptible to this vulnerability.

What products are affected by CVE-2012-3132?

CVE-2012-3132 affects Oracle Database Server versions 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3.

Who can exploit the CVE-2012-3132 vulnerability?

CVE-2012-3132 can be exploited by remote authenticated users with access to specific vectors in the affected Oracle Database versions.

What type of vulnerability is CVE-2012-3132?

CVE-2012-3132 is categorized as an SQL injection vulnerability.